Generated at: 2026-07-30T12:38:02.000Z UTC · source: committed helm-expt evidence for this custom apps page.
Where The Pieces Go
Use the same routing rule as the README: render-changing choices become reviewed bases; post-render refinements become derived ConfigHub variants; production and private inputs belong in managed workflows.
| Piece | Where it belongs | Why |
|---|---|---|
| Public chart | Start from a catalog base when a reviewed chart/version/base exists. | Keeps the upstream Helm source visible. |
| Custom app | Represent your own service as ConfigHub Units alongside chart Units. | Lets the stack be scanned, diffed, promoted, and delivered together. |
| Wrapper chart or overlay values | Use the recipe/import path when the overlay changes Helm render inputs. | This creates or updates a base, not just a derived variant. |
| Environment or customer refinement | Use derived variants when the change is post-render. | Targets, labels, approvals, links, observation policy, and selected field transforms. |
| Agentic app or plugin | Build a domain-specific tool on top of ConfigHub data when raw YAML edits are too low-level. | The tool provides domain semantics, guardrails, dry-run output, and explicit commit steps. |
| Private catalog | Use ConfigHub-managed private paths when private sources, teams, SLAs, or production responsibility enter. | This is the paid and managed boundary. |
Day 0 Or Day 1?
For a new app, multiple charts plus a custom service is Day 0 composition: define the first desired shape, render the bases, upload Units, and create the first target variant. For an app that already exists, the same work is Day 1 change management: import or discover the current shape, compare it with the desired shape, then make controlled refinements.
An agentic custom app can sit beside this path. For example, an RBAC app can read ConfigHub Units, answer Kubernetes-specific access questions, and produce guardrailed edits without asking an agent to patch YAML by hand.
Current Evidence
| Surface | What it shows | Open |
|---|---|---|
| ExternalDNS overlay | Managed overlay golden for wrapper chart plus customer values. | ../data/managed-overlay-goldens/external-dns-customer-acme-prod/README.md |
| RBAC permissions report | Broad permission checks over committed chart renders, with no cluster or fresh Helm run. | ../data/app-readiness/summary.md |
| Live RBAC correction | One exact permission change stored in ConfigHub, blocked until approval, then published as OCI and delivered by Argo CD to an isolated cluster. | ../data/rbac-review-live-proof/summary.md |
| RBAC Manager for Agents | Example CLI/plugin plus agent skills for Kubernetes RBAC inventory, who-can queries, findings, and guardrailed edits. | https://github.com/confighub/examples/tree/main/rbac-manager-for-agents |
| Custom overlays guide | Plain user guide for base plus overlay cases. | ../docs/user/custom-overlays.md |
| Private paths | Commercial and operational boundary for private catalogs. | ./private/ |