ConfigHub Helm Catalog

This is the top-level catalog for choosing a chart and a variant.

Use this page when you want to answer:

New to cub? Install the cub CLI first. You can pull and render public catalog packages without an account. Commands that save or change ConfigHub data require you to sign in.

What can I install?
Which variant should I start with?
Which variant needs existing Secrets or other target facts?
Where is the executable cub installer package?
Where are the proof receipts?

How To Read This Catalog

chart
  variant
    cub installer package base
    rendered objects
    receipts and checks

The root catalog is the entry point. The per-chart CATALOG.md is the evidence folder. The oci:// package ref is what users pass to cub installer setup --pull. The packages/ path is the repo source for maintainers and proof scripts.

Folder Map

CATALOG.md
  Top-level chart and variant index.

recipes/<repo>/<chart>/<version>/CATALOG.md
  Per-chart recipe, variants, rendered objects, receipts, and status.

packages/<repo>/<chart>/<version>/
  Executable cub installer package with one base per variant.

runs/
  Receipts from live, ConfigHub, scan, and safe-ops proof runs.

data/
  Aggregate catalog, production disposition, top-500, and review data.

Live-Tested Catalog Entries

These 20 charts have local kind live/e2e receipts and ConfigHub upload, scan, and safe-ops proof receipts. Start with the first variant unless a different variant matches your intent.

For exact base-variant readiness, including prerequisites and runtime review rows, see Top-20 Base Variant Readiness. The Start Base Status column uses the same generated readiness labels.

At A Glance

Start Base Status Labels

Chart Details

bitnami/redis@25.5.3

Status: catalog-supported Production readiness: production-review-ready Start base readiness: render-only Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: - Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-redis:25.5.3 Source package: packages/bitnami/redis/25.5.3 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

What this command does. cub installer is a released, open-source plugin for the cub CLI. cub installer setup pulls a catalog package and writes its Kubernetes files locally. It does not apply those files to a cluster; use kubectl, Argo CD, or Flux for delivery. The generated scripts stop before doing any work when the plugin or kustomize is missing.

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-redis:25.5.3 --base reuse-existing-secret --work-dir <tmp> --non-interactive --namespace redis

Variants:

default

When to use: Redis static password demo variant rendered from bitnami/redis@25.5.3 Readiness: render-only Namespace: redis Target facts: none Package base: packages/bitnami/redis/25.5.3/bases/default Variant file: recipes/bitnami/redis/25.5.3/variants/default/variant.yaml Rendered objects: recipes/bitnami/redis/25.5.3/revisions/default/r001/rendered/release-objects.yaml Helm equivalence: 14/14 objects matched Receipts: per-chart receipts

reuse-existing-secret (recommended first)

When to use: Redis existing Secret default variant rendered from bitnami/redis@25.5.3 Readiness: render-only Namespace: redis Target facts: required Secret redis/redis-existing-secret keys redis-password Package base: packages/bitnami/redis/25.5.3/bases/reuse-existing-secret Variant file: recipes/bitnami/redis/25.5.3/variants/reuse-existing-secret/variant.yaml Rendered objects: recipes/bitnami/redis/25.5.3/revisions/reuse-existing-secret/r001/rendered/release-objects.yaml Helm equivalence: 13/13 objects matched Receipts: per-chart receipts

metrics-server/metrics-server@3.13.0

Status: catalog-supported Production readiness: production-review-ready Start base readiness: start-here Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: existing-secret (chart ships no Secret toggle) Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/metrics-server-metrics-server:3.13.0 Source package: packages/metrics-server/metrics-server/3.13.0 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/metrics-server-metrics-server:3.13.0 --base default --work-dir <tmp> --non-interactive --namespace kube-system

Variants:

default (recommended first)

When to use: metrics-server default variant rendered from metrics-server/metrics-server@3.13.0 Readiness: start-here Namespace: kube-system Target facts: none Package base: packages/metrics-server/metrics-server/3.13.0/bases/default Variant file: recipes/metrics-server/metrics-server/3.13.0/variants/default/variant.yaml Rendered objects: recipes/metrics-server/metrics-server/3.13.0/revisions/default/r001/rendered/release-objects.yaml Helm equivalence: 9/9 objects matched Receipts: per-chart receipts

external-tls-ca

When to use: metrics-server external TLS with explicit CA variant rendered from metrics-server/metrics-server@3.13.0 Readiness: start-here Namespace: kube-system Target facts: required Secret kube-system/metrics-server-tls keys tls.crt,tls.key; required Value apiService.caBundle (pre-render) Package base: packages/metrics-server/metrics-server/3.13.0/bases/external-tls-ca Variant file: recipes/metrics-server/metrics-server/3.13.0/variants/external-tls-ca/variant.yaml Rendered objects: recipes/metrics-server/metrics-server/3.13.0/revisions/external-tls-ca/r001/rendered/release-objects.yaml Helm equivalence: 9/9 objects matched Receipts: per-chart receipts

ingress-nginx/ingress-nginx@4.15.1

Status: catalog-supported Production readiness: production-review-ready Start base readiness: start-here Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 3/3; ConfigHub 3/3; local live 3/3; GitOps live 3/3; live parity 3/3 Hard gap: - Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/ingress-nginx-ingress-nginx:4.15.1 Source package: packages/ingress-nginx/ingress-nginx/4.15.1 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/ingress-nginx-ingress-nginx:4.15.1 --base internal-clusterip --work-dir <tmp> --non-interactive --namespace ingress-nginx

Variants:

default

When to use: ingress-nginx default variant rendered from ingress-nginx/ingress-nginx@4.15.1 Readiness: start-here Namespace: ingress-nginx Target facts: required Secret ingress-nginx/ingress-nginx-admission keys cert,key,ca Package base: packages/ingress-nginx/ingress-nginx/4.15.1/bases/default Variant file: recipes/ingress-nginx/ingress-nginx/4.15.1/variants/default/variant.yaml Rendered objects: recipes/ingress-nginx/ingress-nginx/4.15.1/revisions/default/r001/rendered/release-objects.yaml Helm equivalence: 11/11 objects matched Receipts: per-chart receipts

admission-disabled

When to use: ingress-nginx admission webhook disabled variant rendered from ingress-nginx/ingress-nginx@4.15.1 Readiness: start-here Namespace: ingress-nginx Target facts: none Package base: packages/ingress-nginx/ingress-nginx/4.15.1/bases/admission-disabled Variant file: recipes/ingress-nginx/ingress-nginx/4.15.1/variants/admission-disabled/variant.yaml Rendered objects: recipes/ingress-nginx/ingress-nginx/4.15.1/revisions/admission-disabled/r001/rendered/release-objects.yaml Helm equivalence: 9/9 objects matched Receipts: per-chart receipts

internal-clusterip (recommended first)

When to use: ingress-nginx internal ClusterIP controller variant rendered from ingress-nginx/ingress-nginx@4.15.1 Readiness: start-here Namespace: ingress-nginx Target facts: none Package base: packages/ingress-nginx/ingress-nginx/4.15.1/bases/internal-clusterip Variant file: recipes/ingress-nginx/ingress-nginx/4.15.1/variants/internal-clusterip/variant.yaml Rendered objects: recipes/ingress-nginx/ingress-nginx/4.15.1/revisions/internal-clusterip/r001/rendered/release-objects.yaml Helm equivalence: 9/9 objects matched Receipts: per-chart receipts

jetstack/cert-manager@v1.20.2

Status: catalog-supported Production readiness: production-review-ready Start base readiness: start-here Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: - Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/jetstack-cert-manager:v1.20.2 Source package: packages/jetstack/cert-manager/v1.20.2 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/jetstack-cert-manager:v1.20.2 --base crds-enabled --work-dir <tmp> --non-interactive --namespace cert-manager

Variants:

default

When to use: cert-manager default variant rendered from jetstack/cert-manager@v1.20.2 Readiness: start-here Namespace: cert-manager Target facts: required CRD challenges.acme.cert-manager.io; required CRD orders.acme.cert-manager.io; required CRD certificaterequests.cert-manager.io; required CRD certificates.cert-manager.io; required CRD clusterissuers.cert-manager.io; required CRD issuers.cert-manager.io Package base: packages/jetstack/cert-manager/v1.20.2/bases/default Variant file: recipes/jetstack/cert-manager/v1.20.2/variants/default/variant.yaml Rendered objects: recipes/jetstack/cert-manager/v1.20.2/revisions/default/r001/rendered/release-objects.yaml Helm equivalence: 42/42 objects matched Receipts: per-chart receipts

crds-enabled (recommended first)

When to use: cert-manager CRDs enabled variant rendered from jetstack/cert-manager@v1.20.2 Readiness: start-here Namespace: cert-manager Target facts: none Package base: packages/jetstack/cert-manager/v1.20.2/bases/crds-enabled Variant file: recipes/jetstack/cert-manager/v1.20.2/variants/crds-enabled/variant.yaml Rendered objects: recipes/jetstack/cert-manager/v1.20.2/revisions/crds-enabled/r001/rendered/release-objects.yaml Helm equivalence: 48/48 objects matched Receipts: per-chart receipts

external-secrets/external-secrets@2.5.0

Status: catalog-supported Production readiness: production-review-ready Start base readiness: start-here Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: - Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/external-secrets-external-secrets:2.5.0 Source package: packages/external-secrets/external-secrets/2.5.0 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/external-secrets-external-secrets:2.5.0 --base default --work-dir <tmp> --non-interactive --namespace external-secrets

Variants:

default (recommended first)

When to use: external-secrets default variant rendered from external-secrets/external-secrets@2.5.0 Readiness: start-here Namespace: external-secrets Target facts: required Secret external-secrets/external-secrets-webhook Package base: packages/external-secrets/external-secrets/2.5.0/bases/default Variant file: recipes/external-secrets/external-secrets/2.5.0/variants/default/variant.yaml Rendered objects: recipes/external-secrets/external-secrets/2.5.0/revisions/default/r001/rendered/release-objects.yaml Helm equivalence: 42/42 objects matched Receipts: per-chart receipts

no-crds

When to use: external-secrets CRDs disabled variant rendered from external-secrets/external-secrets@2.5.0 Readiness: start-here Namespace: external-secrets Target facts: required Secret external-secrets/external-secrets-webhook; required CRD acraccesstokens.generators.external-secrets.io; required CRD cloudsmithaccesstokens.generators.external-secrets.io; required CRD clusterexternalsecrets.external-secrets.io; required CRD clustergenerators.generators.external-secrets.io; required CRD clusterpushsecrets.external-secrets.io; required CRD clustersecretstores.external-secrets.io; required CRD ecrauthorizationtokens.generators.external-secrets.io; required CRD externalsecrets.external-secrets.io; required CRD fakes.generators.external-secrets.io; required CRD gcraccesstokens.generators.external-secrets.io; required CRD generatorstates.generators.external-secrets.io; required CRD githubaccesstokens.generators.external-secrets.io; required CRD grafanas.generators.external-secrets.io; required CRD mfas.generators.external-secrets.io; required CRD passwords.generators.external-secrets.io; required CRD pushsecrets.external-secrets.io; required CRD quayaccesstokens.generators.external-secrets.io; required CRD secretstores.external-secrets.io; required CRD sshkeys.generators.external-secrets.io; required CRD stssessiontokens.generators.external-secrets.io; required CRD uuids.generators.external-secrets.io; required CRD vaultdynamicsecrets.generators.external-secrets.io; required CRD webhooks.generators.external-secrets.io Package base: packages/external-secrets/external-secrets/2.5.0/bases/no-crds Variant file: recipes/external-secrets/external-secrets/2.5.0/variants/no-crds/variant.yaml Rendered objects: recipes/external-secrets/external-secrets/2.5.0/revisions/no-crds/r001/rendered/release-objects.yaml Helm equivalence: 19/19 objects matched Receipts: per-chart receipts

argo-cd/argo-cd@9.5.15

Status: catalog-supported Production readiness: production-review-ready Start base readiness: start-here Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 1/2; GitOps live 2/2; live parity 2/2 Hard gap: ha (curated proof lane - bespoke teaching needed) Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-cd:9.5.15 Source package: packages/argo-cd/argo-cd/9.5.15 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-cd:9.5.15 --base default --work-dir <tmp> --non-interactive --namespace argocd

Variants:

default (recommended first)

When to use: argo-cd default variant rendered from argo-cd/argo-cd@9.5.15 Readiness: start-here Namespace: argocd Target facts: required Secret argocd/argocd-redis keys auth Package base: packages/argo-cd/argo-cd/9.5.15/bases/default Variant file: recipes/argo-cd/argo-cd/9.5.15/variants/default/variant.yaml Rendered objects: recipes/argo-cd/argo-cd/9.5.15/revisions/default/r001/rendered/release-objects.yaml Helm equivalence: 49/49 objects matched Receipts: per-chart receipts

no-crds

When to use: argo-cd CRDs disabled variant rendered from argo-cd/argo-cd@9.5.15 Readiness: render-only Namespace: argocd Target facts: required Secret argocd/argocd-redis keys auth; required CRD applications.argoproj.io; required CRD applicationsets.argoproj.io; required CRD appprojects.argoproj.io Package base: packages/argo-cd/argo-cd/9.5.15/bases/no-crds Variant file: recipes/argo-cd/argo-cd/9.5.15/variants/no-crds/variant.yaml Rendered objects: recipes/argo-cd/argo-cd/9.5.15/revisions/no-crds/r001/rendered/release-objects.yaml Helm equivalence: 46/46 objects matched Receipts: per-chart receipts

bitnami/postgresql@18.6.7

Status: catalog-supported Production readiness: production-review-ready Start base readiness: render-only Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: ha (curated proof lane - bespoke teaching needed) Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-postgresql:18.6.7 Source package: packages/bitnami/postgresql/18.6.7 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-postgresql:18.6.7 --base existing-secret --work-dir <tmp> --non-interactive --namespace postgresql

Variants:

static-passwords

When to use: postgresql static password demo variant rendered from bitnami/postgresql@18.6.7 Readiness: render-only Namespace: postgresql Target facts: none Package base: packages/bitnami/postgresql/18.6.7/bases/static-passwords Variant file: recipes/bitnami/postgresql/18.6.7/variants/static-passwords/variant.yaml Rendered objects: recipes/bitnami/postgresql/18.6.7/revisions/static-passwords/r001/rendered/release-objects.yaml Helm equivalence: 7/7 objects matched Receipts: per-chart receipts

existing-secret (recommended first)

When to use: postgresql existing Secret default variant rendered from bitnami/postgresql@18.6.7 Readiness: render-only Namespace: postgresql Target facts: required Secret postgresql/postgresql-auth keys postgres-password Package base: packages/bitnami/postgresql/18.6.7/bases/existing-secret Variant file: recipes/bitnami/postgresql/18.6.7/variants/existing-secret/variant.yaml Rendered objects: recipes/bitnami/postgresql/18.6.7/revisions/existing-secret/r001/rendered/release-objects.yaml Helm equivalence: 6/6 objects matched Receipts: per-chart receipts

bitnami/rabbitmq@16.0.14

Status: catalog-supported Production readiness: production-review-ready Start base readiness: start-here Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: ha (curated proof lane - bespoke teaching needed) Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-rabbitmq:16.0.14 Source package: packages/bitnami/rabbitmq/16.0.14 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-rabbitmq:16.0.14 --base existing-secret --work-dir <tmp> --non-interactive --namespace rabbitmq

Variants:

static-passwords

When to use: rabbitmq static password demo variant rendered from bitnami/rabbitmq@16.0.14 Readiness: start-here Namespace: rabbitmq Target facts: none Package base: packages/bitnami/rabbitmq/16.0.14/bases/static-passwords Variant file: recipes/bitnami/rabbitmq/16.0.14/variants/static-passwords/variant.yaml Rendered objects: recipes/bitnami/rabbitmq/16.0.14/revisions/static-passwords/r001/rendered/release-objects.yaml Helm equivalence: 10/10 objects matched Receipts: per-chart receipts

existing-secret (recommended first)

When to use: rabbitmq existing Secret default variant rendered from bitnami/rabbitmq@16.0.14 Readiness: start-here Namespace: rabbitmq Target facts: required Secret rabbitmq/rabbitmq-auth keys rabbitmq-password; required Secret rabbitmq/rabbitmq-erlang-cookie keys rabbitmq-erlang-cookie Package base: packages/bitnami/rabbitmq/16.0.14/bases/existing-secret Variant file: recipes/bitnami/rabbitmq/16.0.14/variants/existing-secret/variant.yaml Rendered objects: recipes/bitnami/rabbitmq/16.0.14/revisions/existing-secret/r001/rendered/release-objects.yaml Helm equivalence: 9/9 objects matched Receipts: per-chart receipts

prometheus-community/kube-prometheus-stack@85.3.3

Status: catalog-supported Production readiness: production-review-ready Start base readiness: render-only Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: existing-secret (chart ships no Secret toggle) Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-kube-prometheus-stack:85.3.3 Source package: packages/prometheus-community/kube-prometheus-stack/85.3.3 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-kube-prometheus-stack:85.3.3 --base default --work-dir <tmp> --non-interactive --namespace monitoring

Variants:

default (recommended first)

When to use: kube-prometheus-stack default with Grafana password bound variant rendered from prometheus-community/kube-prometheus-stack@85.3.3 Readiness: render-only Namespace: monitoring Target facts: required Secret monitoring/kube-prometheus-stack-admission keys ca,cert,key; required CRD alertmanagerconfigs.monitoring.coreos.com; required CRD alertmanagers.monitoring.coreos.com; required CRD podmonitors.monitoring.coreos.com; required CRD probes.monitoring.coreos.com; required CRD prometheusagents.monitoring.coreos.com; required CRD prometheuses.monitoring.coreos.com; required CRD prometheusrules.monitoring.coreos.com; required CRD scrapeconfigs.monitoring.coreos.com; required CRD servicemonitors.monitoring.coreos.com; required CRD thanosrulers.monitoring.coreos.com Package base: packages/prometheus-community/kube-prometheus-stack/85.3.3/bases/default Variant file: recipes/prometheus-community/kube-prometheus-stack/85.3.3/variants/default/variant.yaml Rendered objects: recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/default/r001/rendered/release-objects.yaml Helm equivalence: 124/124 objects matched Receipts: per-chart receipts

no-crds

When to use: kube-prometheus-stack CRDs disabled variant rendered from prometheus-community/kube-prometheus-stack@85.3.3 Readiness: render-only Namespace: monitoring Target facts: required Secret monitoring/kube-prometheus-stack-admission keys ca,cert,key; required CRD alertmanagerconfigs.monitoring.coreos.com; required CRD alertmanagers.monitoring.coreos.com; required CRD podmonitors.monitoring.coreos.com; required CRD probes.monitoring.coreos.com; required CRD prometheusagents.monitoring.coreos.com; required CRD prometheuses.monitoring.coreos.com; required CRD prometheusrules.monitoring.coreos.com; required CRD scrapeconfigs.monitoring.coreos.com; required CRD servicemonitors.monitoring.coreos.com; required CRD thanosrulers.monitoring.coreos.com Package base: packages/prometheus-community/kube-prometheus-stack/85.3.3/bases/no-crds Variant file: recipes/prometheus-community/kube-prometheus-stack/85.3.3/variants/no-crds/variant.yaml Rendered objects: recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/no-crds/r001/rendered/release-objects.yaml Helm equivalence: 114/114 objects matched Receipts: per-chart receipts

grafana/loki@7.0.0

Status: catalog-supported Production readiness: production-review-ready Start base readiness: start-here Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: - Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-loki:7.0.0 Source package: packages/grafana/loki/7.0.0 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-loki:7.0.0 --base single-binary-filesystem --work-dir <tmp> --non-interactive --namespace loki

Variants:

single-binary-filesystem (recommended first)

When to use: loki single binary filesystem variant rendered from grafana/loki@7.0.0 Readiness: start-here Namespace: loki Target facts: none Package base: packages/grafana/loki/7.0.0/bases/single-binary-filesystem Variant file: recipes/grafana/loki/7.0.0/variants/single-binary-filesystem/variant.yaml Rendered objects: recipes/grafana/loki/7.0.0/revisions/single-binary-filesystem/r001/rendered/release-objects.yaml Helm equivalence: 19/19 objects matched Receipts: per-chart receipts

simple-scalable-minio

When to use: loki simple scalable with MinIO variant rendered from grafana/loki@7.0.0 Readiness: start-here Namespace: loki Target facts: none Package base: packages/grafana/loki/7.0.0/bases/simple-scalable-minio Variant file: recipes/grafana/loki/7.0.0/variants/simple-scalable-minio/variant.yaml Rendered objects: recipes/grafana/loki/7.0.0/revisions/simple-scalable-minio/r001/rendered/release-objects.yaml Helm equivalence: 33/33 objects matched Receipts: per-chart receipts

longhorn/longhorn@1.11.2

Status: catalog-supported Production readiness: production-review-ready Start base readiness: start-here Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: - Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/longhorn-longhorn:1.11.2 Source package: packages/longhorn/longhorn/1.11.2 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/longhorn-longhorn:1.11.2 --base default --work-dir <tmp> --non-interactive --namespace longhorn-system

Variants:

default (recommended first)

When to use: Longhorn default storage control plane variant rendered from longhorn/longhorn@1.11.2 Readiness: start-here Namespace: longhorn-system Target facts: none Package base: packages/longhorn/longhorn/1.11.2/bases/default Variant file: recipes/longhorn/longhorn/1.11.2/variants/default/variant.yaml Rendered objects: recipes/longhorn/longhorn/1.11.2/revisions/default/r001/rendered/release-objects.yaml Helm equivalence: 41/41 objects matched Receipts: per-chart receipts

ui-ingress

When to use: Longhorn UI ingress enabled variant rendered from longhorn/longhorn@1.11.2 Readiness: start-here Namespace: longhorn-system Target facts: none Package base: packages/longhorn/longhorn/1.11.2/bases/ui-ingress Variant file: recipes/longhorn/longhorn/1.11.2/variants/ui-ingress/variant.yaml Rendered objects: recipes/longhorn/longhorn/1.11.2/revisions/ui-ingress/r001/rendered/release-objects.yaml Helm equivalence: 42/42 objects matched Receipts: per-chart receipts

bitnami/mysql@14.0.3

Status: catalog-supported Production readiness: production-review-ready Start base readiness: start-here Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: ha (curated proof lane - bespoke teaching needed) Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-mysql:14.0.3 Source package: packages/bitnami/mysql/14.0.3 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-mysql:14.0.3 --base existing-secret --work-dir <tmp> --non-interactive --namespace mysql

Variants:

static-passwords

When to use: mysql static password demo variant rendered from bitnami/mysql@14.0.3 Readiness: start-here Namespace: mysql Target facts: none Package base: packages/bitnami/mysql/14.0.3/bases/static-passwords Variant file: recipes/bitnami/mysql/14.0.3/variants/static-passwords/variant.yaml Rendered objects: recipes/bitnami/mysql/14.0.3/revisions/static-passwords/r001/rendered/release-objects.yaml Helm equivalence: 8/8 objects matched Receipts: per-chart receipts

existing-secret (recommended first)

When to use: mysql existing Secret default variant rendered from bitnami/mysql@14.0.3 Readiness: start-here Namespace: mysql Target facts: required Secret mysql/mysql-auth keys mysql-root-password,mysql-password,mysql-replication-password Package base: packages/bitnami/mysql/14.0.3/bases/existing-secret Variant file: recipes/bitnami/mysql/14.0.3/variants/existing-secret/variant.yaml Rendered objects: recipes/bitnami/mysql/14.0.3/revisions/existing-secret/r001/rendered/release-objects.yaml Helm equivalence: 7/7 objects matched Receipts: per-chart receipts

grafana/grafana@10.5.15

Status: catalog-supported Production readiness: production-review-ready Start base readiness: start-here Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: - Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-grafana:10.5.15 Source package: packages/grafana/grafana/10.5.15 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-grafana:10.5.15 --base existing-secret-ingress --work-dir <tmp> --non-interactive --namespace grafana

Variants:

static-passwords

When to use: grafana static password demo variant rendered from grafana/grafana@10.5.15 Readiness: start-here Namespace: grafana Target facts: none Package base: packages/grafana/grafana/10.5.15/bases/static-passwords Variant file: recipes/grafana/grafana/10.5.15/variants/static-passwords/variant.yaml Rendered objects: recipes/grafana/grafana/10.5.15/revisions/static-passwords/r001/rendered/release-objects.yaml Helm equivalence: 9/9 objects matched Receipts: per-chart receipts

existing-secret-ingress (recommended first)

When to use: grafana existing Secret default variant rendered from grafana/grafana@10.5.15 Readiness: start-here Namespace: grafana Target facts: required Secret grafana/grafana-admin keys admin-user,admin-password Package base: packages/grafana/grafana/10.5.15/bases/existing-secret-ingress Variant file: recipes/grafana/grafana/10.5.15/variants/existing-secret-ingress/variant.yaml Rendered objects: recipes/grafana/grafana/10.5.15/revisions/existing-secret-ingress/r001/rendered/release-objects.yaml Helm equivalence: 9/9 objects matched Receipts: per-chart receipts

hashicorp/vault@0.32.0

Status: catalog-supported Production readiness: production-review-ready Start base readiness: start-here Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 3/3; ConfigHub 3/3; local live 2/3; GitOps live 2/3; live parity 2/3 Hard gap: - Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/hashicorp-vault:0.32.0 Source package: packages/hashicorp/vault/0.32.0 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/hashicorp-vault:0.32.0 --base default --work-dir <tmp> --non-interactive --namespace vault

Variants:

dev-mode

When to use: vault dev server without init/unseal variant rendered from hashicorp/vault@0.32.0 Readiness: start-here Namespace: vault Target facts: none Package base: packages/hashicorp/vault/0.32.0/bases/dev-mode Variant file: recipes/hashicorp/vault/0.32.0/variants/dev-mode/variant.yaml Rendered objects: recipes/hashicorp/vault/0.32.0/revisions/dev-mode/r001/rendered/release-objects.yaml Helm equivalence: 11/11 objects matched Receipts: per-chart receipts

default (recommended first)

When to use: vault default server with injector variant rendered from hashicorp/vault@0.32.0 Readiness: start-here Namespace: vault Target facts: none Package base: packages/hashicorp/vault/0.32.0/bases/default Variant file: recipes/hashicorp/vault/0.32.0/variants/default/variant.yaml Rendered objects: recipes/hashicorp/vault/0.32.0/revisions/default/r001/rendered/release-objects.yaml Helm equivalence: 12/12 objects matched Receipts: per-chart receipts

ha-raft-ui

When to use: vault HA Raft with UI variant rendered from hashicorp/vault@0.32.0 Readiness: runtime-watch Namespace: vault Target facts: topology minSchedulableNodes=3 Package base: packages/hashicorp/vault/0.32.0/bases/ha-raft-ui Variant file: recipes/hashicorp/vault/0.32.0/variants/ha-raft-ui/variant.yaml Rendered objects: recipes/hashicorp/vault/0.32.0/revisions/ha-raft-ui/r001/rendered/release-objects.yaml Helm equivalence: 18/18 objects matched Receipts: per-chart receipts

secrets-store-csi-driver/secrets-store-csi-driver@1.6.0

Status: catalog-supported Production readiness: production-review-ready Start base readiness: start-here Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: - Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/secrets-store-csi-driver-secrets-store-csi-driver:1.6.0 Source package: packages/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/secrets-store-csi-driver-secrets-store-csi-driver:1.6.0 --base default --work-dir <tmp> --non-interactive --namespace kube-system

Variants:

default (recommended first)

When to use: secrets-store-csi-driver default Linux driver variant rendered from secrets-store-csi-driver/secrets-store-csi-driver@1.6.0 Readiness: start-here Namespace: kube-system Target facts: none Package base: packages/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/bases/default Variant file: recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/variants/default/variant.yaml Rendered objects: recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/revisions/default/r001/rendered/release-objects.yaml Helm equivalence: 10/10 objects matched Receipts: per-chart receipts

sync-secret-rotation

When to use: secrets-store-csi-driver sync Secret and rotation variant rendered from secrets-store-csi-driver/secrets-store-csi-driver@1.6.0 Readiness: start-here Namespace: kube-system Target facts: none Package base: packages/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/bases/sync-secret-rotation Variant file: recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/variants/sync-secret-rotation/variant.yaml Rendered objects: recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/revisions/sync-secret-rotation/r001/rendered/release-objects.yaml Helm equivalence: 12/12 objects matched Receipts: per-chart receipts

prometheus-community/prometheus@29.8.0

Status: catalog-supported Production readiness: production-review-ready Start base readiness: render-only Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: ha (curated proof lane - bespoke teaching needed) Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-prometheus:29.8.0 Source package: packages/prometheus-community/prometheus/29.8.0 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-prometheus:29.8.0 --base server-only-ephemeral --work-dir <tmp> --non-interactive --namespace monitoring

Variants:

default

When to use: prometheus default monitoring stack variant rendered from prometheus-community/prometheus@29.8.0 Readiness: render-only Namespace: monitoring Target facts: none Package base: packages/prometheus-community/prometheus/29.8.0/bases/default Variant file: recipes/prometheus-community/prometheus/29.8.0/variants/default/variant.yaml Rendered objects: recipes/prometheus-community/prometheus/29.8.0/revisions/default/r001/rendered/release-objects.yaml Helm equivalence: 23/23 objects matched Receipts: per-chart receipts

server-only-ephemeral (recommended first)

When to use: prometheus server only without persistence variant rendered from prometheus-community/prometheus@29.8.0 Readiness: render-only Namespace: monitoring Target facts: none Package base: packages/prometheus-community/prometheus/29.8.0/bases/server-only-ephemeral Variant file: recipes/prometheus-community/prometheus/29.8.0/variants/server-only-ephemeral/variant.yaml Rendered objects: recipes/prometheus-community/prometheus/29.8.0/revisions/server-only-ephemeral/r001/rendered/release-objects.yaml Helm equivalence: 6/6 objects matched Receipts: per-chart receipts

bitnami/mongodb@19.0.7

Status: catalog-supported Production readiness: production-review-ready Start base readiness: render-only Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: - Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-mongodb:19.0.7 Source package: packages/bitnami/mongodb/19.0.7 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-mongodb:19.0.7 --base existing-secret-replicaset --work-dir <tmp> --non-interactive --namespace mongodb

Variants:

static-passwords

When to use: mongodb static password demo variant rendered from bitnami/mongodb@19.0.7 Readiness: render-only Namespace: mongodb Target facts: none Package base: packages/bitnami/mongodb/19.0.7/bases/static-passwords Variant file: recipes/bitnami/mongodb/19.0.7/variants/static-passwords/variant.yaml Rendered objects: recipes/bitnami/mongodb/19.0.7/revisions/static-passwords/r001/rendered/release-objects.yaml Helm equivalence: 8/8 objects matched Receipts: per-chart receipts

existing-secret-replicaset (recommended first)

When to use: mongodb existing Secret default variant rendered from bitnami/mongodb@19.0.7 Readiness: render-only Namespace: mongodb Target facts: required Secret mongodb/mongodb-auth keys mongodb-root-password,mongodb-replica-set-key Package base: packages/bitnami/mongodb/19.0.7/bases/existing-secret-replicaset Variant file: recipes/bitnami/mongodb/19.0.7/variants/existing-secret-replicaset/variant.yaml Rendered objects: recipes/bitnami/mongodb/19.0.7/revisions/existing-secret-replicaset/r001/rendered/release-objects.yaml Helm equivalence: 10/10 objects matched Receipts: per-chart receipts

bitnami/nginx@24.0.2

Status: catalog-supported Production readiness: production-review-ready Start base readiness: render-only Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2 Hard gap: existing-secret (chart ships no Secret toggle) Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-nginx:24.0.2 Source package: packages/bitnami/nginx/24.0.2 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-nginx:24.0.2 --base http-clusterip --work-dir <tmp> --non-interactive --namespace nginx

Variants:

http-clusterip (recommended first)

When to use: nginx plain HTTP ClusterIP variant rendered from bitnami/nginx@24.0.2 Readiness: render-only Namespace: nginx Target facts: none Package base: packages/bitnami/nginx/24.0.2/bases/http-clusterip Variant file: recipes/bitnami/nginx/24.0.2/variants/http-clusterip/variant.yaml Rendered objects: recipes/bitnami/nginx/24.0.2/revisions/http-clusterip/r001/rendered/release-objects.yaml Helm equivalence: 5/5 objects matched Receipts: per-chart receipts

existing-tls-ingress

When to use: nginx existing TLS with ingress variant rendered from bitnami/nginx@24.0.2 Readiness: render-only Namespace: nginx Target facts: required Secret nginx/nginx-backend-tls keys tls.crt,tls.key,ca.crt; required Secret nginx/nginx-ingress-tls keys tls.crt,tls.key Package base: packages/bitnami/nginx/24.0.2/bases/existing-tls-ingress Variant file: recipes/bitnami/nginx/24.0.2/variants/existing-tls-ingress/variant.yaml Rendered objects: recipes/bitnami/nginx/24.0.2/revisions/existing-tls-ingress/r001/rendered/release-objects.yaml Helm equivalence: 6/6 objects matched Receipts: per-chart receipts

grafana/tempo@1.24.4

Status: catalog-supported Production readiness: production-review-ready Start base readiness: start-here Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 1/2; GitOps live 1/2; live parity 1/2 Hard gap: ha (tempo single-binary chart; HA is the separate tempo-distributed chart) Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-tempo:1.24.4 Source package: packages/grafana/tempo/1.24.4 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-tempo:1.24.4 --base local-persistent --work-dir <tmp> --non-interactive --namespace tempo

Variants:

local-persistent (recommended first)

When to use: tempo local persistent single-binary variant rendered from grafana/tempo@1.24.4 Readiness: start-here Namespace: tempo Target facts: none Package base: packages/grafana/tempo/1.24.4/bases/local-persistent Variant file: recipes/grafana/tempo/1.24.4/variants/local-persistent/variant.yaml Rendered objects: recipes/grafana/tempo/1.24.4/revisions/local-persistent/r001/rendered/release-objects.yaml Helm equivalence: 4/4 objects matched Receipts: per-chart receipts

s3-query-observability

When to use: tempo S3 query and observability variant rendered from grafana/tempo@1.24.4 Readiness: runtime-watch Namespace: tempo Target facts: required Secret tempo/tempo-s3-credentials keys access_key,secret_key; required CRD servicemonitors.monitoring.coreos.com; required S3CompatibleObjectStore tempo/tempo-object-store; required Value tempo.storage.trace.s3.endpoint (pre-render); required Value tempo.storage.trace.s3.bucket (pre-render); required Value tempo.storage.trace.s3.region (pre-render) Package base: packages/grafana/tempo/1.24.4/bases/s3-query-observability Variant file: recipes/grafana/tempo/1.24.4/variants/s3-query-observability/variant.yaml Rendered objects: recipes/grafana/tempo/1.24.4/revisions/s3-query-observability/r001/rendered/release-objects.yaml Helm equivalence: 8/8 objects matched Receipts: per-chart receipts

hashicorp/consul@2.0.0

Status: catalog-supported Production readiness: production-review-ready Start base readiness: start-here Strongest evidence: live-helm-vs-confighub-parity Proof lanes: render parity 2/2; ConfigHub 2/2; local live 1/2; GitOps live 1/2; live parity 1/2 Hard gap: ha (curated proof lane - bespoke teaching needed) Installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/hashicorp-consul:2.0.0 Source package: packages/hashicorp/consul/2.0.0 Per-chart catalog: CATALOG.md Helm pain report: helm-pain-report.yaml

Start here:

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/hashicorp-consul:2.0.0 --base default-control-plane --work-dir <tmp> --non-interactive --namespace consul

Variants:

default-control-plane (recommended first)

When to use: consul default control plane variant rendered from hashicorp/consul@2.0.0 Readiness: start-here Namespace: consul Target facts: none Package base: packages/hashicorp/consul/2.0.0/bases/default-control-plane Variant file: recipes/hashicorp/consul/2.0.0/variants/default-control-plane/variant.yaml Rendered objects: recipes/hashicorp/consul/2.0.0/revisions/default-control-plane/r001/rendered/release-objects.yaml Helm equivalence: 68/68 objects matched Receipts: per-chart receipts

secure-mesh-existing-secrets

When to use: consul secure mesh with existing Secrets variant rendered from hashicorp/consul@2.0.0 Readiness: runtime-watch Namespace: consul Target facts: required Secret consul/consul-ca-cert keys tls.crt; required Secret consul/consul-server-cert keys tls.crt,tls.key; required Secret consul/consul-gossip-encryption-key keys key; required Secret consul/consul-bootstrap-acl-token keys token; topology minSchedulableNodes=3 Package base: packages/hashicorp/consul/2.0.0/bases/secure-mesh-existing-secrets Variant file: recipes/hashicorp/consul/2.0.0/variants/secure-mesh-existing-secrets/variant.yaml Rendered objects: recipes/hashicorp/consul/2.0.0/revisions/secure-mesh-existing-secrets/r001/rendered/release-objects.yaml Helm equivalence: 97/97 objects matched Receipts: per-chart receipts

Full Proof Index (110 Entries)

The rows below include the live-tested top 20, proof-grade recipe/package artifacts, and any retained newer chart-version candidates. catalog-supported means reviewed variants for the declared scope. catalog-candidate means a newer or richer candidate is visible for review but is not the supported catalog version. proof-grade means machine-verified artifacts that still need catalog promotion review before support is claimed.