A public OCI containing five reviewed NGINX objects becomes a ConfigHub base without rerendering Helm.
Start here when you open this Space in Hub. This page explains the problem this example is meant to show, what to inspect, why it matters, and where the evidence lives.
Why this example exists
An OCI package can already contain the exact configuration a team reviewed. ConfigHub should accept that artifact without asking the team to rerun its source tool.
This example makes the boundary visible: OCI comes in, ConfigHub records the objects, and later operations can build from that base.
What this example shows
- The public artifact is pinned by digest and pulls without registry credentials.
- It contains the five Kubernetes objects plus source, change, and check records.
- ConfigHub stores one Unit per Kubernetes object and records the OCI source and digest on the Space.
- The source and stored object-set hashes match.
Where each setting comes from
| Place | What this Space records |
|---|---|
| Starting configuration | The public OCI records the reviewed NGINX objects and the one intended change: Deployment/nginx spec.replicas moved from three to four. |
| ConfigHub changes | This base contains the five objects imported from the OCI. No field was changed during upload. |
| Install work | The Deployment still refers to nginx/ai-provider-credentials. Supply that Secret before deployment; it is not stored in the public artifact. |
| Live cluster | No cluster apply or workload observation has run for this specific imported base. |
If an upstream change and a local ConfigHub revision touch the same field, review the overlap before promotion.
What to inspect in Hub
- This README.
- The five Kubernetes Units to inspect the imported objects.
- The Space annotations to see the immutable OCI source.
Evidence and source
- OCI change guide
- Local transformation proof
- Permanent public OCI receipt
- ConfigHub upload receipt
- Plain YAML and OCI summary
Limits
- The artifact is public and digest-pinned, but this example does not claim a provenance signature.
- Direct import of an OCI with companion JSON records needs the merged SDK fix in confighub/sdk PR #11. It is newer than cub v0.2.5 and awaits the next cub release.
- The ConfigHub receipt proves import only. Deployment, promotion, rollback, and workload health are separate examples.