Top 20 Full Proof Target · Config Workshop

What this command does. cub installer is a released, open-source plugin for the cub CLI. cub installer setup pulls a catalog package and writes its Kubernetes files locally. It does not apply those files to a cluster; use kubectl, Argo CD, or Flux for delivery. The generated scripts stop before doing any work when the plugin or kustomize is missing.

Generated at: 2026-07-30T12:38:02.000Z UTC · source: committed helm-expt evidence for this rendered repository document.

The 20-chart milestone means 20 full public-chart proofs, not a spreadsheet with a few deep examples.

Each chart in this target must have:

a recipe directory under recipes/<repo>/<chart>/<version>/;
a cub installer package directory under packages/<repo>/<chart>/<version>/;
source and dependency locks;
HelmPlan and ChartDossier artifacts;
at least one install variant, plus a second meaningful variant when the chart exposes one naturally;
rendered release objects and object inventory per variant revision;
render, Helm-equivalence, scan, install-gate, and installer-package receipts;
deterministic cub installer package proof;
cub installer setup output compared against regular Helm output;
verifier coverage wired into npm run verify;
a row in the generated proof spreadsheet that links back to receipts.

The target count includes Redis because it is the first public-chart full proof.

For the latest chart-version refresh lane, see Latest Top-20 Refresh Plan and:

data/latest-top20-refresh/

Live ConfigHub Proof Status

The top-20 set also has current ConfigHub proof evidence:

20 / 20 ConfigHub proof receipt sets verified

Each receipt set proves the current command path:

New to cub? Install the cub CLI first. You can pull and render public catalog packages without an account. Commands that save or change ConfigHub data require you to sign in.

cub installer doc/setup/render/package/vet/plan/upload
ConfigHub Unit inventory and representative data/revision review
cub variant create staging clone
cub function vet checks
cub changeset + approve + apply --dry-run safe boundary

The runner is quota-aware. For large charts, --cleanup-spaces removes temporary live proof spaces after receipts are written because the Kubara demo org has a finite Link quota. The receipt remains the durable proof artifact and records whether live spaces were retained or deleted after the run.

Latest-Version Status

The current refresh snapshot is generated by:

npm run top20:latest-refresh

Current result:

13 / 20 proofs are on the latest upstream chart version
7 / 20 have newer upstream chart versions available

The seven update candidates are:

argo-cd/argo-cd 9.5.15 -> 9.5.17
bitnami/mongodb 19.0.7 -> 19.1.0
bitnami/nginx 24.0.2 -> 25.0.0
bitnami/postgresql 18.6.7 -> 18.7.0
bitnami/redis 25.5.3 -> 27.0.0
prometheus-community/kube-prometheus-stack 85.3.3 -> 86.1.0
prometheus-community/prometheus 29.8.0 -> 29.9.0

A newer chart version is a work order, not an automatic catalog promotion. Every updated version must rebuild the full recipe/package/proof/live-e2e chain before it replaces the supported catalog row.

The first candidate stage is complete for all seven update candidates:

data/latest-top20-refresh/candidates/
npm run top20:latest-candidates:verify

This proves the latest chart versions can still produce deterministic recipe/package candidate artifacts and cub installer setup output that matches regular Helm semantically. It does not yet prove ConfigHub upload, server-side variant creation, live e2e, or production disposition for the new versions.

Current Status

Full proofs complete: 20 / 20
Remaining full proofs: 0 / 20

#	Chart	Status	Proof Focus
1	`bitnami/redis@25.5.3`	complete	generated facts, existing Secret variant, StatefulSet/PVC, Helm equivalence
2	`metrics-server/metrics-server@3.13.0`	complete	target Secret fact, APIService, capability/RBAC gates
3	`ingress-nginx/ingress-nginx@4.15.1`	complete	admission webhook variant, hook lifecycle policy, cluster RBAC
4	`jetstack/cert-manager@v1.20.2`	complete	CRD-heavy control plane, webhook risk, startup lifecycle policy
5	`external-secrets/external-secrets@2.5.0`	complete	CRD-heavy controller, dependency lock, webhook Secret/cert-controller
6	`argo-cd/argo-cd@9.5.15`	complete	GitOps handoff, CRDs, raw extension slots, cluster RBAC
7	`prometheus-community/kube-prometheus-stack@85.3.3`	complete	large umbrella chart, CRDs, dependencies, webhooks, generated Grafana credential, scale
8	`bitnami/postgresql@18.6.7`	complete	generated credentials, stateful/PVC, upgrade-sensitive values
9	`bitnami/rabbitmq@16.0.14`	complete	generated credentials, Erlang cookie, stateful/PVC, clustering policy
10	`grafana/loki@7.0.0`	complete	blocked default render, required storage/schema values, MinIO object-store variant, ConfigMap normalization
11	`longhorn/longhorn@1.11.2`	complete	22 CRDs, storage lifecycle, privileged/daemon workloads, UI ingress variant
12	`hashicorp/vault@0.32.0`	complete	TLS posture, injector webhook, init/unseal operate policy, HA Raft/UI variant
13	`secrets-store-csi-driver/secrets-store-csi-driver@1.6.0`	complete	CSI driver, CRDs, DaemonSet, RBAC, sync Secret/rotation variant
14	`prometheus-community/prometheus@29.8.0`	complete	monitoring stack, RBAC, PVCs, scrape configuration, server-only variant
15	`grafana/grafana@10.5.15`	complete	deprecated chart status, dashboard/config extension slots, Secret handling, UI ingress exposure
16	`bitnami/mysql@14.0.3`	complete	generated credentials, existing Secret variant, stateful/PVC, service variants
17	`bitnami/mongodb@19.0.7`	complete	generated root password, existing Secret replica-set variant, storage/PDB/network policy
18	`bitnami/nginx@24.0.2`	complete	generated TLS avoidance, existing TLS ingress variant, NetworkPolicy/PDB, low-friction UX
19	`grafana/tempo@1.24.4`	complete	deprecated chart marker, local/S3 storage variants, ServiceMonitor capability, query ingress
20	`hashicorp/consul@2.0.0`	complete	28 CRDs, cluster RBAC, injector webhooks, secure mesh existing-Secret variant

Versions for rows 11-20 are pinned when their proof run is generated. The proof lock, not this planning table, is the source of truth for exact chart package SHA and dependency closure.

Promotion Status

All 20 target rows are promoted. The same contract has now been extended to another 80 public charts in the generated next-80 full-proof lane:

data/next80-full-proofs/

That brings the public proof surface to:

20 bespoke proofs
80 generated full proofs
100 total recipes and cub installer packages

The completed set alternates between deterministic rendered charts, generated-fact stateful charts, large umbrella charts, blocked/default charts, CRD-heavy controllers, and service/control-plane charts. That mix keeps the proof honest while still producing runnable artifacts.

Spreadsheet Doctrine

The top-20 spreadsheet is an evidence map. It must be generated from the proof artifacts and link to each chart's receipts. It is not the proof itself.

Every row should answer, in plain English:

Can I install this safely?
What variants exist?
What did Helm render?
What did cub installer produce?
What differences are intentional?
What scans/gates ran?
What remains risky or blocked?
Where are the receipts?