This example sends two versions of the same AICR PyTorch ClusterTrainingRuntime through ConfigHub. The first version asks for eight H100 nodes, changes a digest-pinned image to latest, and puts a placeholder API key directly in the object. ConfigHub reports the mutable AICR image and blocks the inline API key. It does not run Deployment image or probe checks against this custom resource.
The reviewed version uses four nodes, restores the pinned image, and refers to an existing Secret. Its AICR image and API-key checks are clear. The four-node capacity limit is checked separately against the recorded target facts because the current ConfigHub policy cannot read that target-specific value.
Both versions were uploaded to a temporary Space in the helm-catalog ConfigHub organization. ConfigHub stored the reviewed Kubernetes fields without changing them. Because this is cluster-wide system configuration, ConfigHub blocked the reviewed version until its exact revision was approved. After approval, the same dry run against the recorded OCI target was allowed.
| Check | Result |
|---|---|
| Mutable image in the unsafe AICR proposal | Reported |
| Inline API key in the unsafe AICR proposal | Blocked |
| Deployment image or probe warnings on either AICR object | None |
| AICR image and API-key findings on the reviewed object | None |
| Reviewed object stored without field changes | Pass |
| Content hash changed during approval | No |
| Dry run before approval | Blocked |
| Revision selector | HeadRevisionNum |
| Recorded approvals | 1 |
| Dry run after approval | Allowed |
| Kubernetes apply | Not run |
| Temporary Space removed | Yes |
All apply attempts used --dry-run against an OCI target. This run did not publish a release, read the referenced Secret, start a GPU workload, promote the change, roll it back, or observe a cluster.