Public OCI in, reviewed files, OCI out

A repository document, rendered for the site. View source markdown.

What this command does. cub installer is a released, open-source plugin for the cub CLI. cub installer setup pulls a catalog package and writes its Kubernetes files locally. It does not apply those files to a cluster; use kubectl, Argo CD, or Flux for delivery. The generated scripts stop before doing any work when the plugin or kustomize is missing.

New to cub? Install the cub CLI first. You can pull and render public catalog packages without an account. Commands that save or change ConfigHub data require you to sign in.

Generated at: 2026-07-30T12:38:02.000Z UTC · source: committed helm-expt evidence for this rendered repository document.

UNOFFICIAL/EXPERIMENTAL. This page is generated from a live receipt. Run npm run serverless-oci-gitops:proof to repeat it, or npm run serverless-oci-gitops:proof:verify to check the committed result.

This run started with the public bitnami/nginx@24.0.2 installer package. cub installer pulled it using an empty registry credential file and an isolated cub home with no ConfigHub token. It rendered the http-clusterip configuration as 6 Kubernetes objects.

The same cub installer setup command used --output-oci to package those rendered files as a second OCI artifact. The installer pulled its own output back and checked the object-set digest before returning. Flux then pulled that output digest and applied it to a throwaway cluster. NGINX reached 1/1 ready replicas.

CheckResult
Public installer OCI pulled without registry credentialspass
ConfigHub token presentno
Rendered objects6: Deployment, Namespace, NetworkPolicy, PodDisruptionBudget, Service, ServiceAccount
Rendered OCI written bycub installer setup --output-oci
Output OCI pulled back and compared with the reviewed filespass
Output digestsha256:ac000807c979534860947ea6876e848fa33af7d09230349fb55fdae91991b02a
Flux OCI sourceready
Flux Kustomizationready
Flux-observed digest matches outputpass
NGINX1/1 ready
Cleanuppass

This proves the temporary, no-account OCI -> work -> OCI -> Flux path for this NGINX configuration. It does not prove a permanently hosted output service, and it does not cover charts whose hooks or CRDs need lifecycle routes.