Redis ConfigHub Function Scan Lane

Generated at: 2026-07-30T12:38:02.000Z UTC · source: committed helm-expt evidence for this rendered repository document.

Purpose

This lane proves that the Helm-derived Redis objects uploaded to ConfigHub can be checked with current ConfigHub function validators. It is not a replacement for external scanners such as Trivy, Snyk, kube-linter, or kubeconform. It is the ConfigHub-native scan layer that runs against uploaded Units.

Acceptance Contract

Accepted when:

the scan runs against ConfigHub Units, not only local files;
the selected Units are the Redis Units from the helm-redis-confighub-proof proof space;
every scanned Unit is bound by HeadRevisionNum and DataHash;
at least three current validating functions pass;
failures or missing executors are recorded as blockers, not hidden.

Run

Run date: 2026-05-27

Context:

Organization: Kubara
Server: https://hub.confighub.com
Space: helm-redis-confighub-proof
Selector: Labels.Proof = 'redis-confighub-proof'

Commands:

New to cub? Install the cub CLI first. You can pull and render public catalog packages without an account. Commands that save or change ConfigHub data require you to sign in.

CUB_CONFIG=$HOME/.confighub/config.yaml cub function vet vet-format \
  --space helm-redis-confighub-proof \
  --where "Labels.Proof = 'redis-confighub-proof'" \
  --output json \
  --wait

CUB_CONFIG=$HOME/.confighub/config.yaml cub function vet vet-placeholders \
  --space helm-redis-confighub-proof \
  --where "Labels.Proof = 'redis-confighub-proof'" \
  --output json \
  --wait

CUB_CONFIG=$HOME/.confighub/config.yaml cub function vet vet-merge-keys \
  --space helm-redis-confighub-proof \
  --where "Labels.Proof = 'redis-confighub-proof'" \
  --output json \
  --wait

Result:

Function	What It Checks	Units
`vet-format`	YAML format hazards such as anchors, duplicate keys, empty values, truthy strings, and old octals	14
`vet-placeholders`	unresolved ConfigHub placeholder values	14
`vet-merge-keys`	duplicate Kubernetes strategic merge keys such as duplicate container or env names	14

Receipt:

runs/redis-confighub-proof/latest/function-scan-receipt.yaml

Interpretation

This proves current ConfigHub functions can scan the uploaded Redis Units in place. It is deliberately modest: these checks catch real apply and review hazards, but they do not claim full production security approval.

Production readiness still needs the external scanner and policy disposition already represented by the Redis recipe scan and install gate.