Redis Five-Minute Demo Script

This is the current Redis happy path using only real commands. It does not use future shorthand such as cub installer redis.

Claim

Use the Helm chart.
Get ConfigHub variants.
See exact objects, checks, differences, and OCI proof before production.

Setup

The proof package is already in this repo:

packages/bitnami/redis/25.5.3

It contains two installer bases:

default
reuse-existing-secret

Secret handling is intentionally different between the two bases:

New to cub? Install the cub CLI first. You can pull and render public catalog packages without an account. Commands that save or change ConfigHub data require you to sign in.

default
  Helm renders Secret redis/redis.
  cub installer separates it to out/secrets.
  Apply out/secrets for a direct local test; ConfigHub records references,
  not the rendered secret material.

reuse-existing-secret
  Helm renders no Redis Secret.
  The workloads reference Secret redis/redis-existing-secret key redis-password.
  The installer package declares that Secret as an external requirement and
  the variant records it as a target fact.

For the existing-Secret path, stage the target Secret before applying the rendered manifests:

kubectl --context <your-context> create namespace redis --dry-run=client -o yaml | kubectl --context <your-context> apply -f -
kubectl --context <your-context> -n redis create secret generic redis-existing-secret \
  --from-literal=redis-password=confighub-redis-password \
  --dry-run=client -o yaml | kubectl --context <your-context> apply -f -

Path

1. Render one variant with the current installer package:

What this command does. cub installer is a released, open-source plugin for the cub CLI. cub installer setup pulls a catalog package and writes its Kubernetes files locally. It does not apply those files to a cluster; use kubectl, Argo CD, or Flux for delivery. The generated scripts stop before doing any work when the plugin or kustomize is missing.

cub installer setup \
  --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-redis:25.5.3 \
  --base default \
  --work-dir .tmp/demo/redis-default \
  --non-interactive \
  --namespace redis

Expected result:

Base: default
Rendered 14 manifest(s)
Rendered 1 secret(s) to out/secrets (not uploaded)

1. Prove it still matches Helm:

npm run redis:compare

Expected result:

default: Helm objects 14, cub installer objects 15
semantic object matches: 14/14
Allowed cub-only object: v1|Namespace||redis

reuse-existing-secret: Helm objects 13, cub installer objects 14
semantic object matches: 13/13
Allowed cub-only object: v1|Namespace||redis

1. Prove your rendered work directory matches the cataloged Redis variant:

npm run redis:verify-install:render -- \
  --base default \
  --work-dir .tmp/demo/redis-default \
  --namespace redis

Expected result:

PASS redis:verify-install:render bitnami/redis/25.5.3 default
semantic object matches: 14/14

1. Verify receipts and package determinism:

npm run verify

Expected result:

verified Redis default and reuse-existing-secret proof artifacts
Redis installer package verification passed.

1. Optional local live check:

kubectl --context <your-context> apply -f .tmp/demo/redis-default/out/manifests/namespace-redis.yaml
kubectl --context <your-context> apply -f .tmp/demo/redis-default/out/secrets
kubectl --context <your-context> apply -f .tmp/demo/redis-default/out/manifests

npm run redis:verify-install:cluster -- \
  --base default \
  --context <your-context> \
  --namespace redis

Expected result:

PASS redis:verify-install:cluster bitnami/redis/25.5.3 default
checks: statefulsets, PVCs, Redis PING

For reuse-existing-secret, do not apply out/secrets; that variant renders none. Pre-stage redis/redis-existing-secret as shown above, then apply the manifest directory and verify with --base reuse-existing-secret.

1. Upload to ConfigHub:

cub installer upload \
  --work-dir .tmp/demo/redis-default \
  --space helm-redis-default \
  --component Redis \
  --layer App \
  --environment Demo \
  --owner ConfigHubHelm \
  --variant default \
  --unit-label Component=Redis \
  --unit-label HelmChart=bitnami-redis \
  --unit-label HelmChartVersion=25.5.3 \
  --unit-label Variant=default \
  --unit-label Proof=redis-confighub-proof

Use an authenticated cub CLI in the organization where you want the demo Space to be created. If helm-redis-default already exists, choose a unique Space slug or rerun from the same work directory to reconcile the existing upload.

1. Show the result in ConfigHub:

cub space list --where "Slug LIKE 'helm-redis-%'"
cub unit list --space helm-redis-default \
  --columns Unit.Slug,Unit.Labels.Component,Unit.Labels.HelmChartVersion,Unit.Labels.Variant

npm run redis:verify-install:confighub -- \
  --base default \
  --space helm-redis-default

Expected result:

helm-redis-default: 15 Units
helm-redis-reuse-existing-secret: 15 Units

14 Kubernetes Units are labeled as the Redis variant.
1 installer-record Unit records the installer operation.

PASS redis:verify-install:confighub bitnami/redis/25.5.3 default

1. Show hosted ConfigHub OCI proof:

runs/redis-confighub/latest/upload-oci-receipt.yaml

Expected result:

oci.hub.confighub.com returned OCI manifests for representative Redis StatefulSet Units.
No worker secret or bearer token is recorded.

Close

The five-minute message is:

Helm gave us objects.
ConfigHub gave us named variants, exact diffs, scan/gate status,
upload proof, and OCI-readable operational records.