jetstack/cert-manager@v1.20.2 Production Packet

What this command does. cub installer is a released, open-source plugin for the cub CLI. cub installer setup pulls a catalog package and writes its Kubernetes files locally. It does not apply those files to a cluster; use kubectl, Argo CD, or Flux for delivery. The generated scripts stop before doing any work when the plugin or kustomize is missing.

New to cub? Install the cub CLI first. You can pull and render public catalog packages without an account. Commands that save or change ConfigHub data require you to sign in.

Generated at: 2026-07-30T12:38:02.000Z UTC · source: committed helm-expt evidence for this rendered repository document.

This generated packet summarizes the current support story for a hard chart. It is a navigation surface over existing evidence, not a new support decision.

Current Answer

Field	Value
Supported base	`crds-enabled`
Support decision	`supported`
Production disposition	`blocked`
Target scope	cub-lk-kind-vanilla; namespace=cert-manager; delivery=confighub-oci; controller=argo
Delivery path	`confighub-oci`
Evidence count	16
Strongest user-facing evidence	live-helm-vs-confighub-parity
Live summary	local:2/2 gitops:2/2 live-parity:2/2 two-cluster:2/2

Why This Chart Is Hard

CRD-owning certificate controller with webhook readiness, startup API checks, lifecycle ordering, and issuer/certificate follow-on configuration.

What A User Can Safely Do Today

Use crds-enabled as the first supported base. Treat issuer/provider/hardened resource shapes as separate bases or derived variants with fresh target evidence.

What Remains Before Broader Production Use

Keep the target-scoped evidence fresh before using this supported scope as a production-support example; create separate issuer, certificate, provider, or hardened resource bases for real customer certificate workloads.

Bases

Base	User readiness	Lane summary	Target facts	Command
`crds-enabled`	start-here	render=pass; confighub=pass; local=pass; gitops=pass; live-parity=pass; two-cluster=pass; lifecycle=pass	none	`cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/jetstack-cert-manager:v1.20.2 --base crds-enabled --work-dir <tmp> --non-interactive --namespace cert-manager`
`default`	start-here	render=pass; confighub=pass; local=pass; gitops=pass; live-parity=pass; two-cluster=pass; lifecycle=pass	required CRD challenges.acme.cert-manager.io; required CRD orders.acme.cert-manager.io; required CRD certificaterequests.cert-manager.io; required CRD certificates.cert-manager.io; required CRD clusterissuers.cert-manager.io; required CRD issuers.cert-manager.io	`cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/jetstack-cert-manager:v1.20.2 --base default --work-dir <tmp> --non-interactive --namespace cert-manager`

Quirks And Inputs

Field	Value
Quirks surfaced	extension-slots
User must provide	nothing beyond a cluster and namespace
ConfigHub / installer absorbs	exact rendered objects with render parity and receipts; extension slots routed to reviewed bases
Extension slot route	none recorded

Decision Details

Decision	State
Image policy	`mutable-image-exception-accepted-for-target-scope`
Scan policy	`resource-policy-accepted-for-target-scope`
Lifecycle policy	`lifecycle-observed-for-proof-scope`
Target facts	`no-unresolved-target-prerequisite-in-candidate-base`
Live evidence	`fresh-target-evidence-passed`

Evidence Links

Regenerate:

npm run hard-charts:packets
npm run hard-charts:packets:verify