Redis Safe Operation Lane · ConfigHub Workshop

Purpose

Acceptance Contract

Accepted when:

a changeset is created or reused for the proof;
the changeset can be listed and updated;
a reviewed Redis Unit can be approved;
dry-run apply is attempted through cub unit apply --dry-run;
the apply path blocks clearly if no target exists;
cancel is safe and does not damage the reviewed Unit set.

Run

Run date: 2026-05-27

Context:

Organization: Kubara
Server: https://hub.confighub.com
Space: helm-redis-confighub-proof
Selector: Labels.Proof = 'redis-confighub-proof'

Create the operation record:

New to cub? Install the cub CLI first. Public catalog packages pull and render anonymously, and you sign in only once a command saves or changes ConfigHub data.

CUB_CONFIG=$HOME/.confighub/config.yaml cub changeset create \
  redis-safe-ops-20260527 \
  --space helm-redis-confighub-proof \
  --description "Redis ConfigHub proof safe operation lane" \
  --label Proof=redis-confighub-proof \
  --label Lane=safe-ops \
  --allow-exists

Update it with the proof scope:

CUB_CONFIG=$HOME/.confighub/config.yaml cub changeset update \
  redis-safe-ops-20260527 \
  --space helm-redis-confighub-proof \
  --description "Redis safe-ops proof: approve reviewed revisions, dry-run apply only" \
  --annotation proof.confighub.com/scope=local-test \
  --annotation proof.confighub.com/live-apply=false

The committed receipt below is a legacy per-Unit approval observation. It is kept as evidence of that historical run, not as the current recommendation.

That run approved one representative reviewed Unit with the command below. cub unit approve has since been removed from cub. An approval is now an attestation, made with cub variant approve. It is bound to a change order only when you name one with --change-order and --stage. Keep the block as a record of what ran, not as a command to run.

CUB_CONFIG=$HOME/.confighub/config.yaml cub unit approve \
  statefulset-redis-redis-master \
  --space helm-redis-confighub-proof \
  --revision HeadRevisionNum \
  --verbose \
  --wait

Result:

Unit statefulset-redis-redis-master (...) has been approved
Awaiting triggers...

The result above is historical receipt output. A current ChangeWorkflow can require qualifying attestations through its configured attestation prerequisite; recording an attestation does not configure or migrate that prerequisite.

For a current Space-level approval, use cub variant approve. It records Approval attestations for the selected revisions and carries them to later revisions of the same Unit only when their content is identical. This command selects Target-bearing Units unless --all is supplied; --where narrows the selection. This proof Space has no Target, so --all is required:

CUB_CONFIG=$HOME/.confighub/config.yaml cub variant approve \
  helm-redis-confighub-proof \
  --all \
  --where "Slug = 'statefulset-redis-redis-master'" \
  --revision HeadRevisionNum \
  --verbose

Attempt dry-run apply:

CUB_CONFIG=$HOME/.confighub/config.yaml cub unit apply \
  --space helm-redis-confighub-proof \
  --where "Labels.Proof = 'redis-confighub-proof'" \
  --dry-run \
  --wait \
  --timeout 2m

Result:

Failed: cannot invoke action on a unit without a target

Cancel is safe:

CUB_CONFIG=$HOME/.confighub/config.yaml cub unit cancel \
  --space helm-redis-confighub-proof \
  --where "Labels.Proof = 'redis-confighub-proof'"

Result:

No units found matching the filter

Receipt:

runs/redis-confighub-proof/latest/safe-ops-receipt.yaml

Interpretation

This is a good result. The proof space has reviewed Redis Units but no attached target, so ConfigHub blocks even a dry-run apply at the operation boundary. For workerless ConfigHub, this is the behavior we want:

no target or observation receipt -> no claim that anything was deployed

The next live-safe step is to attach a disposable local target and repeat this lane with a dry-run or local-kind apply receipt.