Review a recorded configuration for argo-cd/argo-workflows@1.0.14. Read its exact Kubernetes objects, required setup, and current evidence before you deploy it.
The first recorded configuration is default. Read its status before use; it is not yet a polished public example. The page does not claim every possible values combination.
Evidence labels: Pass has a linked result. Watch names a limit to check. Blocked means do not use that path yet.
Upstream: the Catalog fetched chart argo-workflows from the Helm repository https://argoproj.github.io/argo-helm at version 1.0.14. find this chart on Artifact Hub · Helm documentation. This page adds checked configurations and test results.
Needs first. The controller and server require the Argo Workflows APIs. Helm normally downloads and applies the full CRDs in a hook before those workloads start.
Every chart page follows the same order. Choose a configuration, inspect its objects and setup work, then read the tests that have run. Open the worked examples.
The page names the work and says which delivery path has actually run.
What To Use
default configuration: 19 rendered objects · 2 images · 8 target prerequisites · 1 hook or setup step · 6/7 checks passing. These counts come from the linked test records.
defaultFirst recorded base variant
3Candidate base variants
Review before useFirst-configuration status
Not reviewed for productionProduction status
The recipe/package proof exists and useful variants exist, but this chart has not been promoted into the public catalog.
No specific missing capability is recorded. The first configuration still needs review.
Namespace
default
Four Separate Questions
Inspecting a source, producing objects, checking a destination, and checking a live result are different jobs. A Catalog match is useful for comparison but is not required. A missing destination or deployment is shown as not run or blocked, not as a failed configuration.
Question
Current answer
What it needs
Status
What do I have?
Inspect the helm source, choices, locks, and any existing output before selecting a destination.
Destination access: no Selected configuration deployed: no
Available to inspect evidence recorded
What will it produce?
Run the recorded Helm render step to produce the exact Kubernetes objects for this configuration.
Destination access: no Selected configuration deployed: no
Checked: passed evidence recorded
Can this destination accept it?
The destination has not been checked for this exact configuration. A recorded source or render result is not a destination pass.
Destination access: yes Selected configuration deployed: no
Not run no run recorded
Did it work?
No post-deployment result is recorded for this exact configuration. Publication, upload, or rendering is not proof that it ran correctly.
None in the catalog base. Later edits appear in ConfigHub Unit revision history or a derived variant.
1 hook or setup step recorded.
Upgrade rule: if a new Helm render and a ConfigHub revision both change the same field, review the overlap before promotion. The values profile shows the Helm side; Unit revision history shows the ConfigHub side.
Shipping a chart as plain rendered YAML is faster and simpler, and it silently drops anything Helm was going to do afterwards. This section reports what a scan of the packaged chart found, across 45 files.
Construct
Found
Why it matters when a chart ships as plain YAML
Helm hooks
4
Hook Jobs never fire, or fire under a different hook dialect.
Keep policy
9
A reconciler prunes what Helm promised to keep.
Capability branching
3
The chart chooses apiVersions from the cluster it renders against.
Custom resource definitions
8
Per-file delivery can race the definitions the resources depend on.
A flattening-safety verdict has decided this version: controller-default-reviewed:flatten-with-routes; default:flatten-with-routes; minimal-crds:flatten-with-routes. The verdict records one disposition per construct and names any companion artifact a flattened bundle must ship. What the flattening verdict means.
A construct being present does not make a chart unflattenable. Most are switched on or off by values, and a verdict records which ones the base you choose actually reaches. Read the catalog-wide evidence for how common each one is.
What The Starting Configuration Records
A base variant is a starting configuration we have already rendered and checked. Pick the one whose trade-off you want; the table below shows what each one changes. How the values for each are chosen.
The default base-variant record connects those Helm inputs to the Kubernetes objects, remaining requirements, hooks, CRDs, checks, and OCI status. Open it when you need the complete starting record rather than only the rendered YAML.
Open the full rendered YAML to read the actual manifest output. The render record and setup section explain the inputs, tests, CRDs, hooks, and other work around it.
If new Helm values create a useful starting configuration, record another base variant with its own inputs and checks. If one environment changes a field after rendering, record that change in a ConfigHub variant.
The exact installer package for this chart version. The version tag is readable, and the manifest digest makes a published pull immutable. Public catalog package refs are published in Google Artifact Registry with anonymous read access. No ConfigHub account or Google registry login is needed for the local setup path.
Required before apply
8 CRDs Included in the OCI package as prerequisites/target-facts/default-crds.yaml. It refreshes the locked CRDs with the chart's server-side, force-conflicts apply mode. The generated try script runs this step before the workload and waits for every CRD to become established.
External resources the recommended base variant expects, such as an existing Secret, namespace, CRD, or target fact.
Instructions and decisions for hooks, CRDs, generated Secrets, setup jobs, cluster requirements, or blockers.
Choose base variant
Pick the supported Helm configuration for this chart: default, no-CRDs, existing Secret, HA, server-only, or another listed option.
Record inputs
Keep the values, namespace, release name, source lock, default render intent, full YAML output, package base, test results, and setup instructions together.
Handle chart extras
CRDs, hooks, setup jobs, external Secrets, target facts, and webhook certificates are recorded as chart-specific choices. Some are included in a base variant, some need a setup step, and some are blocked until there is a safe path.
Review default before use. If a card says review or preparation is needed, treat that as a real limit rather than a ready install.
Package image
Exact package:oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-workflows:1.0.14@sha256:abbebaeccc07e0583c7ccc5ad0c9d315057e6b4c0a766bd72c167ee92d3f160f publication receipt recorded · open the exact publication receipt
Readable version tag: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-workflows:1.0.14. The package is pinned so a republished tag cannot change what you get. The command below uses the exact manifest digest, so cub installer refuses different package bytes.
cub installer pull 'oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-workflows:1.0.14@sha256:abbebaeccc07e0583c7ccc5ad0c9d315057e6b4c0a766bd72c167ee92d3f160f' --work-dir ./package-review
less ./package-review/package/records/README.md
The package's records/ directory connects every base to its source choices, Helm render intent, Kubernetes objects, prerequisites, lifecycle work, and checks. These are supporting records, not Kubernetes objects.
Verify the package publisher
Run this command with cosign. It checks the expected publisher, the exact manifest digest, and the package annotations.
A valid signature identifies who signed these package bytes. It does not show that the configuration is suitable for your cluster; use this page's checks and setup instructions for that decision.
Public catalog package refs are published in Google Artifact Registry with anonymous read access. No ConfigHub account or Google registry login is needed for the local setup path.
Run the whole sequence as one script, prerequisites included: try.sh renders and applies to Kubernetes without an account; confighub.sh renders and uploads to your ConfigHub Space.
Before you run try.sh: it changes your current kubectl context. It runs the named prerequisites and applies the rendered objects. Read it first and use a disposable test cluster. confighub.sh does not apply anything to Kubernetes.
You should see something like this
Here is what the command does. cub installer is an open-source plugin for the cub CLI. cub installer setup pulls a catalog package and writes its Kubernetes files locally, leaving delivery to kubectl, Argo CD or Flux. The generated scripts stop before doing any work when the plugin or kustomize is missing.
cub installer setup ...
rendered manifests written under <work-dir>
use the chart option cards below to check pass, watch, blocked, and prerequisites
Current status: Available in the catalog · Reason: Promotion was tested and recorded in ConfigHub.
Use this entry in ConfigHub
Every Catalog entry page carries these five steps in this order. Each step says what the Catalog has run for this entry, and a step with a missing precondition gives no command.
Steps 1 and 2 need no account. Install the cub CLI before any cub command. Step 2 uses cub config diff, which cub plugin install confighub/cub-workshop@v0.6.61 adds. This page covers 3 entries, so open the one you want. A live walk on 2026-10-08 ran steps 3 to 5 for bitnami-nginx-24-0-2-http-clusterip and nvidia-gpu-operator-v26-3-3-default. These commands carry the changes that walk needed. It is a dated log and no receipt, so no state on this page rests on it.
Helm chart, base default, version 1.0.14What is fixed, and what you supply
Fixed when this entry was built. These went into the build, so the objects already carry them. To change one, build the entry again from its source.
chart is argo-cd/argo-workflows
version is 1.0.14
base is default
valuesProfile is recipes/argo-cd/argo-workflows/1.0.14/effective-values.yaml
namespace is default
releaseName is argo-workflows
capabilityProfile is {"apiVersions":[],"kubeVersion":"1.30.0"}
Yours to supply or check. The destination must have these before the objects are applied. The words in italics say what the Catalog knows about each.
clusterworkflowtemplates.argoproj.io Declared. Not checked on any destination.
cronworkflows.argoproj.io Declared. Not checked on any destination.
workflowartifactgctasks.argoproj.io Declared. Not checked on any destination.
workfloweventbindings.argoproj.io Declared. Not checked on any destination.
workflows.argoproj.io Declared. Not checked on any destination.
workflowtaskresults.argoproj.io Declared. Not checked on any destination.
workflowtasksets.argoproj.io Declared. Not checked on any destination.
workflowtemplates.argoproj.io Declared. Not checked on any destination.
This entry's plan, and how to test it
These are the steps that plain objects cannot carry. ConfigHub stores them and does not carry them out. The words in italics say what the Catalog knows about each.
Before you deliver. The controller and server require the Argo Workflows APIs. Helm normally downloads and applies the full CRDs in a hook before those workloads start. Who: cub installer package script. Seen in a recorded run.
Test the install steps yourself.This script carries them out with kubectl on a cluster you choose, with no account. Read it first and use a throwaway cluster. The Catalog has no recorded run of this script.
Test the plain objects.A second script tests the retained objects themselves with kubectl, and it needs no cub and no account. The Catalog has no recorded run of this script.
Compared with plain Helm. The Catalog installed this base beside plain Helm on two local clusters, and the two matched. Read the receipt.
The Catalog rendered this entry and retains its 19 objects in one file.
An upload can create more Units than the objects counted here. The installer renders a Namespace, and the upload adds an installer-record Unit.
# fetch the retained objects for this entry$ curl -fsSL -o argo-cd-argo-workflows-1-0-14-default.yaml https://raw.githubusercontent.com/confighub/helm-expt/main/recipes/argo-cd/argo-workflows/1.0.14/revisions/default/r001/rendered/release-objects.yaml
# check the bytes against the listing$ shasum -a 256 argo-cd-argo-workflows-1-0-14-default.yaml
677516f7d311ffdfcf7a4b424585cada43ba104af51ef7e283c575d8279c16bc argo-cd-argo-workflows-1-0-14-default.yaml
# render this base from the signed package; step 3 uploads this directory$ cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-workflows:1.0.14@sha256:abbebaeccc07e0583c7ccc5ad0c9d315057e6b4c0a766bd72c167ee92d3f160f --base default --work-dir ./argo-cd-argo-workflows-1-0-14-default --non-interactive --namespace default
2. Compare with another version or base Not run for this entry
The listing records no comparison for this entry. The commands run on the retained files, with no account. This version has 2 other bases in the Catalog, controller-default-reviewed and minimal-crds.
# fetch the controller-default-reviewed base of the same version$ curl -fsSL -o argo-cd-argo-workflows-1-0-14-controller-default-reviewed.yaml https://raw.githubusercontent.com/confighub/helm-expt/main/recipes/argo-cd/argo-workflows/1.0.14/revisions/controller-default-reviewed/r001/rendered/release-objects.yaml
# list what differs between the two bases$ cub config diff argo-cd-argo-workflows-1-0-14-default.yaml argo-cd-argo-workflows-1-0-14-controller-default-reviewed.yaml --summary
Replace each value in angle brackets with a name of your own. The entry id may already exist as a Space in your organization, and the package name as a Component.
In the live walk, a Space named for the nginx entry's id and a Component named bitnami-nginx already existed, so the walk chose its own names. The --component flag sets the Component label the upload writes on the Space, which is the package name when you omit it.
The cub installer plugin reads your organization from CUB_CONTEXT and ignores --context. If you use a context other than your default, export CUB_CONTEXT first, or the plugin works in your default organization.
# sign in; steps 3 to 5 write to your ConfigHub organization$ cub auth login
# upload step 1's directory as a Space of Units, under names you choose$ cub installer upload --work-dir ./argo-cd-argo-workflows-1-0-14-default --space <your-space> --component <your-component>
# list the Units the upload created$ cub unit list --space <your-space>
4. Deploy it Not run for this entry
No delivery run is recorded for this entry. Argo CD has not run, Flux has not run, and kubectl has not run. The commands name the Target workshop/target, which cub cluster up --name workshop creates on a local kind cluster with Argo CD. Use your own Target for a real destination. The listing records 8 inputs that the destination must supply, so read them before you deploy. The coverage lanes record a GitOps OCI run for this base. They are separate from the delivery record this step reads. Read the log of the live walk on 2026-10-08.
Use the Space name you chose in step 3. The delete command is needed because the cloned installer-record Unit carries the Target and Argo CD v3.5.4 cannot read it, a defect seen on cub v0.8.7 and server v0.8.9.
Without that line the walk deployed nothing and Argo CD showed Unknown, while every cub command exited 0. The walk ran the four commands in this order and did not try them without the first publish.
ConfigHub shows nothing when Argo CD fails to read a Release. Run kubectl -n argocd get applications.argoproj.io and read the Sync column, because Healthy alone is not a pass. Argo CD took between 18 seconds and about 5 minutes to read a Release on a cluster made without argobot.
The walk made its cluster with cub cluster up --no-argobot. That command creates two Spaces, a Worker, a Target and a Trigger, opens ports 30010 to 30019 on the machine, and installs Argo CD from an unpinned upstream manifest.
Removing the ConfigHub side does not remove the workload. In the walk, deleting the Application Unit and the Spaces left the Application and its pods running, because the root Application does not prune.
# clone the base onto a Target as a dev variant$ cub variant create dev <your-space> --target workshop/target --space-pattern "template:<your-space>-dev"
# publish the Release that the cluster's Argo CD pulls$ cub release publish <your-space>-dev
# delete the installer record, which Argo CD cannot read$ cub unit delete --space <your-space>-dev installer-record
# publish again without it$ cub release publish <your-space>-dev
5. Promote a change Partly run for this entry
A promotion ran for this entry. It ran the preview and the promote. The delete and the publish below have no recorded run for this entry. Promotion carries a change in the base to the dev variant. The base changes when you edit a Unit or upload a newer version into the same Space. Read the log of the live walk on 2026-10-08 · Read the record that states this.
The promotion changes the dev Space and publishes nothing. It also adds the installer-record Unit back with the Target. The change reaches the cluster only after the delete and the publish.
The preview lists the whole installer record as added. In the walk, the preview of a one-label change to gpu-operator ran to 405 lines, and about 400 of them were that record.
# preview what the dev variant would take from the base$ cub variant promote <your-space>-dev --dry-run -o mutations
# promote once you have read the preview$ cub variant promote <your-space>-dev --change-desc "Pull the reviewed base forward"
# delete the installer record that the promotion adds back$ cub unit delete --space <your-space>-dev installer-record
# publish the Release that carries the change$ cub release publish <your-space>-dev
Helm chart, base controller-default-reviewed, version 1.0.14What is fixed, and what you supply
Fixed when this entry was built. These went into the build, so the objects already carry them. To change one, build the entry again from its source.
chart is argo-cd/argo-workflows
version is 1.0.14
base is controller-default-reviewed
valuesProfile is recipes/argo-cd/argo-workflows/1.0.14/effective-values.yaml
namespace is default
releaseName is argo-workflows
capabilityProfile is {"apiVersions":[],"kubeVersion":"1.30.0"}
Yours to supply or check. The destination must have these before the objects are applied. The words in italics say what the Catalog knows about each.
clusterworkflowtemplates.argoproj.io Declared. Not checked on any destination.
cronworkflows.argoproj.io Declared. Not checked on any destination.
workflowartifactgctasks.argoproj.io Declared. Not checked on any destination.
workfloweventbindings.argoproj.io Declared. Not checked on any destination.
workflows.argoproj.io Declared. Not checked on any destination.
workflowtaskresults.argoproj.io Declared. Not checked on any destination.
workflowtasksets.argoproj.io Declared. Not checked on any destination.
workflowtemplates.argoproj.io Declared. Not checked on any destination.
This entry's plan, and how to test it
These are the steps that plain objects cannot carry. ConfigHub stores them and does not carry them out. The words in italics say what the Catalog knows about each.
Before you deliver. full CRDs required before workflow-controller and server can start; hook uses server-side apply because full CRDs exceed client-side apply annotation limits Who: cub installer package script. Recorded as routed.
Test the install steps yourself.This script carries them out with kubectl on a cluster you choose, with no account. Read it first and use a throwaway cluster. The Catalog has no recorded run of this script.
Test the plain objects.A second script tests the retained objects themselves with kubectl, and it needs no cub and no account. The Catalog has no recorded run of this script.
Compared with plain Helm. The Catalog installed this base beside plain Helm on two local clusters, and the two matched. Read the receipt.
The Catalog rendered this entry and retains its 19 objects in one file.
An upload can create more Units than the objects counted here. The installer renders a Namespace, and the upload adds an installer-record Unit.
# fetch the retained objects for this entry$ curl -fsSL -o argo-cd-argo-workflows-1-0-14-controller-default-reviewed.yaml https://raw.githubusercontent.com/confighub/helm-expt/main/recipes/argo-cd/argo-workflows/1.0.14/revisions/controller-default-reviewed/r001/rendered/release-objects.yaml
# check the bytes against the listing$ shasum -a 256 argo-cd-argo-workflows-1-0-14-controller-default-reviewed.yaml
677516f7d311ffdfcf7a4b424585cada43ba104af51ef7e283c575d8279c16bc argo-cd-argo-workflows-1-0-14-controller-default-reviewed.yaml
# render this base from the signed package; step 3 uploads this directory$ cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-workflows:1.0.14@sha256:abbebaeccc07e0583c7ccc5ad0c9d315057e6b4c0a766bd72c167ee92d3f160f --base controller-default-reviewed --work-dir ./argo-cd-argo-workflows-1-0-14-controller-default-reviewed --non-interactive --namespace default
2. Compare with another version or base Not run for this entry
The listing records no comparison for this entry. The commands run on the retained files, with no account. This version has 2 other bases in the Catalog, default and minimal-crds.
# fetch the default base of the same version$ curl -fsSL -o argo-cd-argo-workflows-1-0-14-default.yaml https://raw.githubusercontent.com/confighub/helm-expt/main/recipes/argo-cd/argo-workflows/1.0.14/revisions/default/r001/rendered/release-objects.yaml
# list what differs between the two bases$ cub config diff argo-cd-argo-workflows-1-0-14-controller-default-reviewed.yaml argo-cd-argo-workflows-1-0-14-default.yaml --summary
Replace each value in angle brackets with a name of your own. The entry id may already exist as a Space in your organization, and the package name as a Component.
In the live walk, a Space named for the nginx entry's id and a Component named bitnami-nginx already existed, so the walk chose its own names. The --component flag sets the Component label the upload writes on the Space, which is the package name when you omit it.
The cub installer plugin reads your organization from CUB_CONTEXT and ignores --context. If you use a context other than your default, export CUB_CONTEXT first, or the plugin works in your default organization.
# sign in; steps 3 to 5 write to your ConfigHub organization$ cub auth login
# upload step 1's directory as a Space of Units, under names you choose$ cub installer upload --work-dir ./argo-cd-argo-workflows-1-0-14-controller-default-reviewed --space <your-space> --component <your-component>
# list the Units the upload created$ cub unit list --space <your-space>
4. Deploy it Not run for this entry
No delivery run is recorded for this entry. Argo CD has not run, Flux has not run, and kubectl has not run. The commands name the Target workshop/target, which cub cluster up --name workshop creates on a local kind cluster with Argo CD. Use your own Target for a real destination. The listing records 8 inputs that the destination must supply, so read them before you deploy. The coverage lanes record a GitOps OCI run for this base. They are separate from the delivery record this step reads. Read the log of the live walk on 2026-10-08.
Use the Space name you chose in step 3. The delete command is needed because the cloned installer-record Unit carries the Target and Argo CD v3.5.4 cannot read it, a defect seen on cub v0.8.7 and server v0.8.9.
Without that line the walk deployed nothing and Argo CD showed Unknown, while every cub command exited 0. The walk ran the four commands in this order and did not try them without the first publish.
ConfigHub shows nothing when Argo CD fails to read a Release. Run kubectl -n argocd get applications.argoproj.io and read the Sync column, because Healthy alone is not a pass. Argo CD took between 18 seconds and about 5 minutes to read a Release on a cluster made without argobot.
The walk made its cluster with cub cluster up --no-argobot. That command creates two Spaces, a Worker, a Target and a Trigger, opens ports 30010 to 30019 on the machine, and installs Argo CD from an unpinned upstream manifest.
Removing the ConfigHub side does not remove the workload. In the walk, deleting the Application Unit and the Spaces left the Application and its pods running, because the root Application does not prune.
# clone the base onto a Target as a dev variant$ cub variant create dev <your-space> --target workshop/target --space-pattern "template:<your-space>-dev"
# publish the Release that the cluster's Argo CD pulls$ cub release publish <your-space>-dev
# delete the installer record, which Argo CD cannot read$ cub unit delete --space <your-space>-dev installer-record
# publish again without it$ cub release publish <your-space>-dev
5. Promote a change Partly run for this entry
A promotion ran for this entry. It ran the preview and the promote. The delete and the publish below have no recorded run for this entry. Promotion carries a change in the base to the dev variant. The base changes when you edit a Unit or upload a newer version into the same Space. Read the log of the live walk on 2026-10-08 · Read the record that states this.
The promotion changes the dev Space and publishes nothing. It also adds the installer-record Unit back with the Target. The change reaches the cluster only after the delete and the publish.
The preview lists the whole installer record as added. In the walk, the preview of a one-label change to gpu-operator ran to 405 lines, and about 400 of them were that record.
# preview what the dev variant would take from the base$ cub variant promote <your-space>-dev --dry-run -o mutations
# promote once you have read the preview$ cub variant promote <your-space>-dev --change-desc "Pull the reviewed base forward"
# delete the installer record that the promotion adds back$ cub unit delete --space <your-space>-dev installer-record
# publish the Release that carries the change$ cub release publish <your-space>-dev
Helm chart, base minimal-crds, version 1.0.14What is fixed, and what you supply
Fixed when this entry was built. These went into the build, so the objects already carry them. To change one, build the entry again from its source.
chart is argo-cd/argo-workflows
version is 1.0.14
base is minimal-crds
valuesProfile is recipes/argo-cd/argo-workflows/1.0.14/effective-values-minimal-crds.yaml
namespace is default
releaseName is argo-workflows
capabilityProfile is {"apiVersions":[],"kubeVersion":"1.30.0"}
Yours to supply or check. The listing records no input for the destination. The Catalog has not ruled one out for your cluster.
This entry's plan, and how to test it
These are the steps that plain objects cannot carry. ConfigHub stores them and does not carry them out. The words in italics say what the Catalog knows about each.
Before you deliver. Argo Workflows default full CRDs are installed through a Helm hook using server-side apply; this base chooses the self-contained minimal-CRD route instead. Who: whatever applies the objects. Seen in a recorded run.
When you deliver. Apply the 8 CustomResourceDefinition objects first. Wait until every named definition reports the Established condition. The listing gives the rest. Who: whatever applies the objects. Written down. Not run by the Catalog.
Once the destination is known. Helm was asked to keep these objects when the release goes away. A reconciler that prunes anything absent from its desired state will delete them instead, and for a custom resource definition that takes every resource of that kind with it. The listing gives the rest. Who: whatever applies the objects. Written down. Not run by the Catalog.
Test the install steps yourself.This script carries them out with kubectl on a cluster you choose, with no account. Read it first and use a throwaway cluster. The Catalog has no recorded run of this script.
Test the plain objects.A second script tests the retained objects themselves with kubectl, and it needs no cub and no account. The Catalog has no recorded run of this script.
Compared with plain Helm. The Catalog installed this base beside plain Helm on two local clusters, and the two matched. Read the receipt.
The Catalog rendered this entry and retains its 27 objects in one file.
An upload can create more Units than the objects counted here. The installer renders a Namespace, and the upload adds an installer-record Unit.
# fetch the retained objects for this entry$ curl -fsSL -o argo-cd-argo-workflows-1-0-14-minimal-crds.yaml https://raw.githubusercontent.com/confighub/helm-expt/main/recipes/argo-cd/argo-workflows/1.0.14/revisions/minimal-crds/r001/rendered/release-objects.yaml
# check the bytes against the listing$ shasum -a 256 argo-cd-argo-workflows-1-0-14-minimal-crds.yaml
8c1919f7c1841fb4dbaf12f2d110c82e4426e8e766310cc850efe81d2fb2fd4b argo-cd-argo-workflows-1-0-14-minimal-crds.yaml
# render this base from the signed package; step 3 uploads this directory$ cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-workflows:1.0.14@sha256:abbebaeccc07e0583c7ccc5ad0c9d315057e6b4c0a766bd72c167ee92d3f160f --base minimal-crds --work-dir ./argo-cd-argo-workflows-1-0-14-minimal-crds --non-interactive --namespace default
2. Compare with another version or base Not run for this entry
The listing records no comparison for this entry. The commands run on the retained files, with no account. This version has 2 other bases in the Catalog, controller-default-reviewed and default.
# fetch the default base of the same version$ curl -fsSL -o argo-cd-argo-workflows-1-0-14-default.yaml https://raw.githubusercontent.com/confighub/helm-expt/main/recipes/argo-cd/argo-workflows/1.0.14/revisions/default/r001/rendered/release-objects.yaml
# list what differs between the two bases$ cub config diff argo-cd-argo-workflows-1-0-14-minimal-crds.yaml argo-cd-argo-workflows-1-0-14-default.yaml --summary
Replace each value in angle brackets with a name of your own. The entry id may already exist as a Space in your organization, and the package name as a Component.
In the live walk, a Space named for the nginx entry's id and a Component named bitnami-nginx already existed, so the walk chose its own names. The --component flag sets the Component label the upload writes on the Space, which is the package name when you omit it.
The cub installer plugin reads your organization from CUB_CONTEXT and ignores --context. If you use a context other than your default, export CUB_CONTEXT first, or the plugin works in your default organization.
# sign in; steps 3 to 5 write to your ConfigHub organization$ cub auth login
# upload step 1's directory as a Space of Units, under names you choose$ cub installer upload --work-dir ./argo-cd-argo-workflows-1-0-14-minimal-crds --space <your-space> --component <your-component>
# list the Units the upload created$ cub unit list --space <your-space>
4. Deploy it Not run for this entry
No delivery run is recorded for this entry. Argo CD has not run, Flux has not run, and kubectl has not run. The commands name the Target workshop/target, which cub cluster up --name workshop creates on a local kind cluster with Argo CD. Use your own Target for a real destination. The coverage lanes record a local Kubernetes run and a GitOps OCI run for this base. They are separate from the delivery record this step reads. Read the log of the live walk on 2026-10-08.
Use the Space name you chose in step 3. The delete command is needed because the cloned installer-record Unit carries the Target and Argo CD v3.5.4 cannot read it, a defect seen on cub v0.8.7 and server v0.8.9.
Without that line the walk deployed nothing and Argo CD showed Unknown, while every cub command exited 0. The walk ran the four commands in this order and did not try them without the first publish.
ConfigHub shows nothing when Argo CD fails to read a Release. Run kubectl -n argocd get applications.argoproj.io and read the Sync column, because Healthy alone is not a pass. Argo CD took between 18 seconds and about 5 minutes to read a Release on a cluster made without argobot.
The walk made its cluster with cub cluster up --no-argobot. That command creates two Spaces, a Worker, a Target and a Trigger, opens ports 30010 to 30019 on the machine, and installs Argo CD from an unpinned upstream manifest.
Removing the ConfigHub side does not remove the workload. In the walk, deleting the Application Unit and the Spaces left the Application and its pods running, because the root Application does not prune.
# clone the base onto a Target as a dev variant$ cub variant create dev <your-space> --target workshop/target --space-pattern "template:<your-space>-dev"
# publish the Release that the cluster's Argo CD pulls$ cub release publish <your-space>-dev
# delete the installer record, which Argo CD cannot read$ cub unit delete --space <your-space>-dev installer-record
# publish again without it$ cub release publish <your-space>-dev
5. Promote a change Partly run for this entry
A promotion ran for this entry. It ran the preview and the promote. The delete and the publish below have no recorded run for this entry. Promotion carries a change in the base to the dev variant. The base changes when you edit a Unit or upload a newer version into the same Space. Read the log of the live walk on 2026-10-08 · Read the record that states this.
The promotion changes the dev Space and publishes nothing. It also adds the installer-record Unit back with the Target. The change reaches the cluster only after the delete and the publish.
The preview lists the whole installer record as added. In the walk, the preview of a one-label change to gpu-operator ran to 405 lines, and about 400 of them were that record.
# preview what the dev variant would take from the base$ cub variant promote <your-space>-dev --dry-run -o mutations
# promote once you have read the preview$ cub variant promote <your-space>-dev --change-desc "Pull the reviewed base forward"
# delete the installer record that the promotion adds back$ cub unit delete --space <your-space>-dev installer-record
# publish the Release that carries the change$ cub release publish <your-space>-dev
After You Render It
The first command writes files and does not apply them. Read the objects and setup requirements, then choose the next job.
cub plugin install confighub/homebrew-tap@cub-scan-v0.7.3 --name scan cub check --format json --output cub-check.json <work-dir>/out/manifests. The check is advisory and does not apply anything.
Apply the rendered manifests with kubectl, or publish reviewed objects as OCI
The normal Helm install runs a hook that downloads eight full CRD files from GitHub and applies them before the controller and server. Those CRDs are not in the ordinary rendered release, so another delivery path has to replace that step deliberately.
The catalog package contains the exact eight files used by this chart version. Their source URLs and digests are recorded. The no-account script applies them with the same server-side, force-conflicts mode as the Helm hook, waits for them to become established, and then applies the ordinary objects.
Choice
What happens
default
Uses the full upstream CRD schemas. The package applies the locked CRD bundle before the workloads.
minimal-crds
Renders eight smaller CRDs as ordinary objects. This avoids the hook but uses looser schemas that preserve unknown fields.
Argo CD or Flux
Ordering still needs its own controller-specific proof. The direct package result does not claim either controller ran this step automatically.
Two clean kind clusters checked the direct path: Helm ran its real hook in one, the catalog package ran its CRD action in the other, all eight live CRD specifications matched, the 19 ordinary objects matched, and both workloads became ready.
Each card is one available way to use this chart in the catalog. Some cards are runnable base variants. Others are candidate paths, derived variants, or review notes that explain what still has to be prepared.
Checks: Each card names what was checked and says whether it passed, needs review, was blocked, was not run, or was not needed.
try.sh renders, settles the prerequisites in order, and applies with kubectl; confighub.sh renders and uploads to your ConfigHub Space.
Evidence
Live helm vs confighub parity
Hooks/actions
1 source hook; hook step: observed; live action receipt: yes; 1 recorded lifecycle step
Who runs actions?
You or your delivery pipeline (1); the full record shows which delivery paths have receipts
Lifecycle record
1 chart-specific lifecycle step is recorded. The full record separates direct, Argo CD, and Flux handling and says which paths have actually run. Open the full record.
Prerequisites
8 prerequisites are declared for this base. Each prerequisite says whether it must be checked before render or before apply.
Next
Run catalog promotion review
Reason
Promotion was tested and recorded in ConfigHub.
Helm outputPassedSaved in ConfigHubPassedLocal clusterBlockedSetup stepPassedGitOps and OCIPassedLive Helm comparisonPassedTwo clustersPassedPromotionPassed
try.sh renders, settles the prerequisites in order, and applies with kubectl; confighub.sh renders and uploads to your ConfigHub Space.
Evidence
Live helm vs confighub parity
Hooks/actions
1 source hook; hook step: candidate-route; live action receipt: todo; 1 recorded lifecycle step
Who runs actions?
Not automated yet (1); the full record shows which delivery paths have receipts
Lifecycle record
1 chart-specific lifecycle step is recorded. The full record separates direct, Argo CD, and Flux handling and says which paths have actually run. Open the full record.
Prerequisites
8 prerequisites are declared for this base. Each prerequisite says whether it must be checked before render or before apply.
Next
Run catalog promotion review
Reason
Promotion was tested and recorded in ConfigHub.
Helm outputPassedSaved in ConfigHubPassedLocal clusterBlockedSetup stepNot runGitOps and OCIPassedLive Helm comparisonPassedTwo clustersPassedPromotionPassed
try.sh renders, settles the prerequisites in order, and applies with kubectl; confighub.sh renders and uploads to your ConfigHub Space.
Evidence
Live helm vs confighub parity
Hooks/actions
1 source hook; hook step: observed; live action receipt: yes; 1 recorded lifecycle step
Who runs actions?
Kubernetes or the delivery controller (1); the full record shows which delivery paths have receipts
Lifecycle record
1 chart-specific lifecycle step is recorded. The full record separates direct, Argo CD, and Flux handling and says which paths have actually run. Open the full record.
Prerequisites
This base has not yet been reviewed for required Secrets, CRDs, namespaces, values, storage services, external APIs, or target topology. Record what it needs, or record that nothing extra is required.
Next
Run catalog promotion review
Reason
Promotion was tested and recorded in ConfigHub.
Helm outputPassedSaved in ConfigHubPassedLocal clusterPassedSetup stepPassedGitOps and OCIPassedLive Helm comparisonPassedTwo clustersPassedPromotionPassed
We ran cub check v0.7.3 against the exact rendered objects for every configuration below. The result is advisory: read each finding and decide whether it matters for your target.
What this does not check: hook execution, CRD readiness, target Secrets and cloud services, admission behavior, workload health, or rollback. The linked Catalog review covers chart-specific source and operating questions. ConfigHub validation and approval are separate managed controls.
Every reference below comes from the reviewed rendered output. What you see is what the cluster pulls. These references are data: you can change a registry or pin a digest with a recorded edit, and prove the change landed in every environment.
Some chart paths need a small preparation step before the cub path feels as smooth as Helm. We show those steps here so the first run does not surprise you.
Caveat
What to do
Universal caveats
Use declared inputs or bases instead of Helm --set. For direct delivery, define pruning and field-conflict behavior. Use Argo CD or Flux when that controller path and its pruning settings are recorded for the selected preset.
Shared placeholder password
No shared placeholder password caveat recorded for this chart.
CRD first-ordering
Yes. 8 CRDs must exist first. The public package contains the bootstrap, and its generated try.sh applies it and waits for the CRDs before installing the main objects.
Did this version string point at changed upstream bytes?
Not checked
No linked result
How much is proven, and what more testing would add: Fully proven: Render parity, ConfigHub proof, GitOps/OCI live, Live Helm-vs-ConfigHub, Two-cluster kind. Proven on some bases: Local live.
Base
Readiness
Render
ConfigHub
Local live
GitOps/OCI
Live parity
Two-cluster kind
default
real
yes
yes
no
yes
yes
yes
controller-default-reviewed
real
yes
yes
no
yes
yes
yes
minimal-crds
real
yes
yes
yes
yes
yes
yes
What You Must Provide
exact rendered objects with render parity and receipts; optional chart inputs handled by reviewed base configurations
Field
Value
Known quirks
optional chart inputs
You must provide
nothing beyond a cluster and namespace
What ConfigHub records
exact rendered objects with render parity and receipts; optional chart inputs handled by reviewed base configurations
Optional chart inputs
Tpl powered values
How optional inputs are handled
Keep empty in supported bases; Or make a reviewed installer base when populated
Hooks, CRDs, And Setup Work
Some Helm charts need work before, during, or after apply: CRDs, hooks, setup jobs, webhook certificates, migrations, generated Secrets, or checks. For each chart, the catalog should make the choice clear: include it in the base variant, split it into a separate base variant, run a setup step, use a GitOps action where evidence exists, require an existing target resource, or block it when there is no safe default.
What each base needs before apply
These requirements come from the same base definition as the rendered objects. The render intent keeps the chart inputs, required Secrets or CRDs, lifecycle steps, and evidence together.
Base variant
Required resource
How to provide it
Full record
default
8 CRDs
Included in the OCI package as prerequisites/target-facts/default-crds.yaml. It refreshes the locked CRDs with the chart's server-side, force-conflicts apply mode. The generated try script runs this step before the workload and waits for every CRD to become established.
Included in the OCI package as prerequisites/target-facts/controller-default-reviewed-crds.yaml. It refreshes the locked CRDs with the chart's server-side, force-conflicts apply mode. The generated try script runs this step before the workload and waits for every CRD to become established.
If no plan is shown, that does not prove the upstream chart has no hooks. It means the public catalog has no chart-specific action to show yet; check the matrix or send a problem chart if hook behavior should be modeled. Direct apply, Argo CD, Flux, and upgrade implementations are tracked separately. One passing implementation does not prove the others.
controller-default-reviewed: package applies 8 CRDs first
Hook or setup step
Who handles it?
Argo CD mapping
Flux mapping
Change for this variant
crd-install (preflight-or-presync-crd-apply) full CRDs required before workflow-controller and server can start; hook uses server-side apply because full CRDs exceed client-side apply annotation limits
Prerequisite - run the generated package script before the workloads
packaged-action - the package carries the 8 CRDs and its generated script applies them before the workload; this base still needs its own live route receipt
Evidence:data/hook-route-candidates/candidates.csv Next: direct full-CRD package route is proven; next prove controller-run ordering under Argo CD and Flux and test a cross-version CRD upgrade
default: package applies 8 CRDs first
Hook or setup step
Who handles it?
Argo CD mapping
Flux mapping
Change for this variant
crd-install (preflight-or-presync-crd-apply) The controller and server require the Argo Workflows APIs. Helm normally downloads and applies the full CRDs in a hook before those workloads start.
Handled - the generated package script applies the CRDs first
crd-install (self-contained-crd-base) Argo Workflows default full CRDs are installed through a Helm hook using server-side apply; this base chooses the self-contained minimal-CRD route instead.
Your applier - must apply CRDs before dependent objects
no extra hook - keep CRDs before dependent objects
no extra hook - make sure CRDs are applied before workloads
resolved - this base installs the required CRDs (observed live)
A green render or local live result is not a production support claim. Production support is target-scoped and uses the support-decision artifact when present.
default, controller-default-reviewed. The plain-objects script stops before it applies anything. One step of the plan is yours to do first, and it prints it. When you run it again it applies the objects and ends. It does not wait for the workloads to start. Neither script runs the steps the plan names for an upgrade or a delete.
minimal-crds. The plain-objects script applies the objects and ends. It does not wait for the workloads to start. Neither script runs the steps the plan names for an upgrade or a delete.