These live checks turn catalog advice into rules before ConfigHub applies stored configuration.
Start here when you open this Space in Hub. This page explains the problem this example is meant to show, what to inspect, why it matters, and where the evidence lives.
Why this example exists
A catalog recommendation is useful before upload. After upload, the same recommendation should stop a known bad apply or report a clear warning instead of remaining prose.
These checks run against the exact configuration stored in ConfigHub. They make the catalog's safety advice visible at the point where a change would move.
What this example shows
- A gate named
Block applystops a definite problem: invalid Kubernetes data, an unfinished placeholder, an unsupported lifecycle claim, an inline AICR API key, or a missing required approval. - A check named
Warnreports a possible problem without stopping apply: an unpinned image or missing health probes. - Production releases require approval. Cluster-wide system configuration also requires approval in development and staging because one change can affect every workload.
- Open or hover over any live ApplyGate to read what it checks, why the catalog uses it, and how to clear it.
Where each setting comes from
| Place | What this Space records |
|---|---|
| Starting configuration | Open the upstream Space or source link named on this page. That is the configuration this Space started from. |
| ConfigHub changes | Open Unit revision history. It records changes made after the starting configuration was saved. |
| Install work | Use the linked chart or route evidence for required Secrets, CRDs, hooks, setup jobs, and target facts. |
| Live cluster | Use target observations to compare the cluster with the reviewed Units. A live-only edit is drift until it is recorded or removed. |
If an upstream change and a local ConfigHub revision touch the same field, review the overlap before promotion.
What to inspect in Hub
- This README.
- The Triggers and Filters in this Space; their friendly names say whether they block or warn.
- A gated Unit, then hover over its ApplyGate to read the purpose and repair.
- Production Spaces such as
bitnami-redis-prodandhashicorp-vault-env-prodto see where approval matters.
Evidence and source
Limits
- The lifecycle gate validates a LifecycleRoute that exists. It cannot discover an unrecorded hook, CRD, setup job, or target prerequisite.
- This example explains shared demo mechanics. It is not a replacement for a company policy model.