UNOFFICIAL/EXPERIMENTAL. Generated by scripts/generate-cub-adoption-caveats.mjs; do not hand-edit. Regenerate with npm run cub-adoption-caveats:generate. Secret values are never decoded or printed - only password key names are read.
This is the per-chart view of the adoption audit (docs/planning/helm-vs-cub-adoption-audit.md, PR #1016): for each of the 100 charts, which "worse-than / more-confusing-than plain Helm" rough edges apply, and the exact fix.
Three caveats that apply to EVERY chart (cub-direct path)
These are the same for all 100 charts, so they are stated once here rather than repeated per chart. Use a controller (Argo/Flux) and all three are handled for you; on the bare cub-direct path the managed applier handles them.
- Customize with
--inputor a base edit, not Helm's--set- cub rejects--set/--values(the typo guard); declared values use--input, the rest by choosing/editing a kustomize base.- Managed: Guided errors + migration cheat-sheet (#1020, docs/user/helm-to-cub-migration.md).
- Upgrades don't auto-delete removed objects on cub-direct - A plain
kubectl applyleaves orphans when an upgrade removes a resource.- Managed: Managed applier uses
--prune(#1019), or use a controller (Argo/Flux) which prunes natively.
- Managed: Managed applier uses
- A manual
kubectl editconflicts on server-side re-apply - Safer than Helm's silent overwrite, but a Helm user expects the overwrite.- Managed: Managed applier surfaces a plain-words message +
--force-conflicts(#1019).
- Managed: Managed applier surfaces a plain-words message +
Per-chart caveats (these vary by chart)
2/100 charts still bake a shared placeholder password in their default setup; 41/100 charts ship CRDs that need first-ordering on cub-direct. Full data for all 100 charts: caveats.csv · summary.html.
Shared placeholder password (#1012) - 2 charts
If a chart appears here, its default base bakes a password Secret that is the same for everyone. The safer package shape is an existing-Secret base: create or supply the Secret before apply, keep the Secret material outside the rendered chart, and make any fixed-password demo base explicit.
| Chart | Default base | Password keys | Fix |
|---|---|---|---|
| falcosecurity/falcosidekick | default | 1 | replace the placeholder before prod |
| runix/pgadmin4 | default | 1 | replace the placeholder before prod |
CRDs need first-ordering on cub-direct (#1015) - 41 charts
On the bare kubectl apply path a chart's CRs can apply before its CRDs are established. A controller handles ordering; on cub-direct, apply CRDs first and wait, or use the managed applier (#1019).
| Chart | Default base | CRDs | Fix |
|---|---|---|---|
| aqua/trivy-operator | default | 12 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| argo-cd/argo-cd | default | 3 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| argo-cd/argo-events | default | 3 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| argo-cd/argo-rollouts | default | 5 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| argo-cd/argo-workflows | default | 8 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| argo-cd/argocd-image-updater | default | 1 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| autoscaler/vertical-pod-autoscaler | default | 2 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| bitnami/contour | default | 5 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| cloudnative-pg/cloudnative-pg | default | 10 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| elastic/eck-operator | default | 12 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| external-dns/external-dns | default | 1 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| external-secrets/external-secrets | default | 23 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| fairwinds-stable/vpa | default | 2 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| gatekeeper/gatekeeper | default | 17 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| grafana/alloy | default | 1 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| grafana/pyroscope | default | 1 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| grafana/rollout-operator | default | 2 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| hashicorp/consul | default-control-plane | 28 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| hashicorp/terraform | default | 1 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| jaegertracing/jaeger-operator | default | 1 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| jetstack/cert-manager | default | 6 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| jetstack/trust-manager | default | 3 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| kedacore/keda | default | 6 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| kyverno/kyverno | default | 22 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| kyverno/kyverno-policies | default | 1 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| linkerd/linkerd-crds | default | 8 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| longhorn/longhorn | default | 22 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| minio-operator/operator | default | 2 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| minio-operator/tenant | default | 1 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| nats/nack | default | 6 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| open-telemetry/opentelemetry-operator | default | 6 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| percona/pg-operator | default | 8 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| percona/psmdb-operator | default | 3 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| percona/pxc-operator | default | 3 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| rook-release/rook-ceph | default | 25 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| rook-release/rook-ceph-cluster | default | 5 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| sealed-secrets/sealed-secrets | default | 1 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| secrets-store-csi-driver/secrets-store-csi-driver | default | 2 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| strimzi/strimzi-kafka-operator | default | 10 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| traefik/traefik | default | 25 | no-crds base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| velero/velero | default | 13 | apply CRDs first + wait, or use a controller (#1015/#1019) |
How to read this
- A chart not listed in either per-chart table still has the three universal caveats - those are the floor.
- Every fix here is proven: managed delivery applier (#1019) and setup guidance (#1020).
- The cleanest blanket fix for the delivery caveats (prune, CRD ordering, SSA) is use a controller - they were never config quirks, only bare-apply behaviors.