This guide explains the journey from a public Helm chart to a ConfigHub Space. Use it when you want to know why this preset exists, what problem it solves, how to repeat it, and what still needs care.
It is generated from the same records that build the package, chart page, render intent, scripts, and receipts. The proof links are lower down.
Why this preset exists
Helm charts often expose many settings, but a values file alone does not tell the whole operations story. A team still needs to know what Kubernetes objects will be created, which Secrets or CRDs must already exist, whether hooks or setup jobs need special handling, and what evidence backs the result.
This preset is a named answer for one useful operating choice. It keeps the upstream chart, records the inputs and rendered YAML, and gives the team a repeatable starting point instead of a private values-file guess.
What this is
This is the no-crds preset config for kyverno/kyverno@3.8.1. The repo also calls this a base variant. Use this when your platform, GitOps bootstrap, or another chart owns the CRDs.
The matching catalog page is kyverno/kyverno@3.8.1.
The chart journey
We keep the Helm chart. We lock kyverno/kyverno@3.8.1, choose the no-crds preset config, render it with the recorded values, namespace, release name, and Kubernetes capabilities, then save the output as files.
That captured output is the render variant: recipes/kyverno/kyverno/3.8.1/revisions/no-crds/r001/rendered/release-objects.yaml. It contains 47 Kubernetes object(s): ClusterRole x16, ClusterRoleBinding x7, Service x6, Deployment x4, Role x4, RoleBinding x4, ServiceAccount x4, ConfigMap x2.
The public package is oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/kyverno-kyverno:3.8.1. Users can pull it without cloning this repo. When someone runs cub installer upload, ConfigHub stores the rendered Kubernetes YAML in a Space so it can be searched, compared, reviewed, changed, and delivered. The example script defaults to Space helm-kyverno-no-crds, but users can choose another name with CUB_SPACE=....
What to check
This preset config records 22 prerequisites: 22 CRDs. The public package includes the files used to prepare them, and the generated try script applies them in the required order.
The catalog records 6 extra steps for this preset. We call these lifecycle routes because they say what must happen before, during, or after Kubernetes applies the main set of files.
- Before install: preserve-ordering.
- Before install: target-facts-or-preflight.
- After install: explicit-test-check.
- During upgrade: upgrade-action-with-receipt.
- When uninstalling: delete-cleanup-policy.
- When uninstalling: preserve-cleanup-policy.
CRDs are made into an explicit choice instead of being mixed into the application install. CRD ownership is recorded as part of the preset config. Some CRDs must already exist before the rendered objects are applied. Hooks, setup jobs, and other install or upgrade steps are listed separately, so you can see what must run and when. Known limitation: existing-secret (chart ships no Secret toggle).
Why you can trust it
- The chart version, source, namespace, release name, values, and capability profile are recorded in the render intent.
- The render variant is committed as YAML and contains 47 Kubernetes object(s).
- The installer package OCI ref points to the package users pull for this chart version.
- Render parity is recorded as passing for this preset config.
- Prerequisites are named before apply, so they are not discovered after rollout.
- Hook and lifecycle work is counted and linked to the route record.
This is a claim about this recorded preset config. It is not a claim that every possible values file for this chart has been checked.
Repeat it
Fast path with no ConfigHub account:
bash <(curl -fsSL https://confighub.github.io/helm-expt/site/sh/kyverno-kyverno-3-8-1/no-crds/try.sh)Fast path with a ConfigHub account:
bash <(curl -fsSL https://confighub.github.io/helm-expt/site/sh/kyverno-kyverno-3-8-1/no-crds/confighub.sh)The core render command is:
New to cub? Install the cub CLI first. You can pull and render public catalog packages without an account. Commands that save or change ConfigHub data require you to sign in.
What this command does. cub installer is a released, open-source plugin for the cub CLI. cub installer setup pulls a catalog package and writes its Kubernetes files locally. It does not apply those files to a cluster; use kubectl, Argo CD, or Flux for delivery. The generated scripts stop before doing any work when the plugin or kustomize is missing.
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/kyverno-kyverno:3.8.1 --base no-crds --work-dir ./kyverno-kyverno-3-8-1-no-crds --non-interactive --namespace defaultAfter upload, create environment versions with cub variant create and move reviewed changes with cub variant promote. The walkthrough is After Upload: Create A Variant And Promote Changes.
Preset details
| Item | Value |
|---|---|
| Chart | kyverno/kyverno@3.8.1 |
| Preset config | no-crds |
| Namespace | default |
| Release name | kyverno |
| Values | recipes/kyverno/kyverno/3.8.1/effective-values-no-crds.yaml |
| Render intent | data/helm-render-intents/intents/kyverno-kyverno-3-8-1-no-crds.yaml |
| Render variant | recipes/kyverno/kyverno/3.8.1/revisions/no-crds/r001/rendered/release-objects.yaml |
| Package base | packages/kyverno/kyverno/3.8.1/bases/no-crds |
| Scripts | try.sh · confighub.sh |
Prerequisites and lifecycle steps
| When | What | How it is handled |
|---|---|---|
| Before install | 22 CRDs: cleanuppolicies.kyverno.io, clustercleanuppolicies.kyverno.io, clusterpolicies.kyverno.io, globalcontextentries.kyverno.io, policies.kyverno.io, policyexceptions.kyverno.io, updaterequests.kyverno.io, clusterephemeralreports.reports.kyverno.io, ephemeralreports.reports.kyverno.io, clusterpolicyreports.wgpolicyk8s.io, policyreports.wgpolicyk8s.io, deletingpolicies.policies.kyverno.io, generatingpolicies.policies.kyverno.io, imagevalidatingpolicies.policies.kyverno.io, mutatingpolicies.policies.kyverno.io, namespaceddeletingpolicies.policies.kyverno.io, namespacedgeneratingpolicies.policies.kyverno.io, namespacedimagevalidatingpolicies.policies.kyverno.io, namespacedmutatingpolicies.policies.kyverno.io, namespacedvalidatingpolicies.policies.kyverno.io, policyexceptions.policies.kyverno.io, validatingpolicies.policies.kyverno.io | Included in the public package as prerequisites/target-facts/no-crds-crds.yaml. The generated try script applies it and waits for the required CRD before installing the main objects. |
| Before install | Keep the required apply order | preserve-ordering. |
| Before install | Prepare the target | target-facts-or-preflight. |
| After install | Run the chart check | explicit-test-check. |
| During upgrade | Run the upgrade step | upgrade-action-with-receipt. |
| When uninstalling | Use the chart's cleanup policy | delete-cleanup-policy. |
| When uninstalling | Keep the chart's cleanup policy | preserve-cleanup-policy. |
Evidence
| Check | Status |
|---|---|
| Render parity | yes |
| ConfigHub scan/upload proof | yes |
| Earlier local-cluster test | yes |
| GitOps OCI live run | yes |
| Live Helm vs ConfigHub comparison | yes |
| Lifecycle routes | 6 |
Limits
- Known gap for this row: existing-secret (chart ships no Secret toggle).
- Resolve the named gap first: existing-secret (chart ships no Secret toggle).
Source files
- Chart page: https://confighub.github.io/helm-expt/site/charts/kyverno-kyverno-3-8-1.html
- Render intent:
data/helm-render-intents/intents/kyverno-kyverno-3-8-1-no-crds.yaml - Rendered YAML:
recipes/kyverno/kyverno/3.8.1/revisions/no-crds/r001/rendered/release-objects.yaml - Package source:
packages/kyverno/kyverno/3.8.1/bases/no-crds - Generated scripts:
site/sh/kyverno-kyverno-3-8-1/no-crds - Preset doctrine: Helm Chart Presets And Values