Run it with Flux, Argo CD, or kubectl

1. Reconcile a published component now

Two reviewed components are already published to the public namespace. Point Flux at one with no account, and it reconciles.

flux create source oci nginx \
  --url=oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-nginx-rendered --tag=24.0.2
flux create kustomization nginx --source=OCIRepository/nginx --path="." --prune=true

This is proven end to end. Flux fetched digest sha256:ac21cf32 from the public URL and the nginx workload reached ready, in a cluster with no ConfigHub credentials. Redis is published the same way at bitnami-redis-rendered:25.5.3; provide its existing Secret before it reconciles.

ConfigHub runs that registry for this catalog, and every published version stays available at its tag and digest. Only nginx and Redis are pre-published as rendered images so far; every other chart page shows its own delivery receipts, and the Catalog says which ones have an Argo CD or Flux run behind them.

For any other catalog chart, render your own controller-native OCI and push it to a registry you control.

New to cub? Install the cub CLI first. Public catalog packages pull and render anonymously, and you sign in only once a command saves or changes ConfigHub data.

Here is what the command does. cub installer is an open-source plugin for the cub CLI. cub installer setup pulls a catalog package and writes its Kubernetes files locally, leaving delivery to kubectl, Argo CD or Flux. The generated scripts stop before doing any work when the plugin or kustomize is missing.

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-nginx:24.0.2@sha256:7cf08c0348a32d577ffa0e16069ec6c2510ce773b372008d25b938f9546c5f67 \
  --base http-clusterip --output-oci oci://YOUR-REGISTRY/reviewed-nginx:24.0.2

Argo CD reads the same output through an OCI Application, and kubectl applies the same files. A registry as source of truth records who pushed an artifact and when. It does not record whether the bytes were reviewed, or what objects change at the next version. Those are the digest-drift check and the render diff.

You can review a change before it reconciles, then build or govern a whole platform, with Flux still the reconciler.

2. Verify before you reconcile

A certified bundle carries its receipt as an attached record. Pull it by digest, verify it, then hand it to the reconciler. The workshop plugin does this for its shipped renders today, and any registry you control works, including a local one.

cub plugin install confighub/cub-workshop
cub config check redis --out oci://YOUR-REGISTRY/redis:v1
cub config verify oci://YOUR-REGISTRY/redis@sha256:<digest from the line above>

cub config verify refuses an image that has no receipt, and it names any file whose bytes differ from what the receipt lists. What ConfigHub Workshop is says what a receipt covers and what it does not.

3. Render, inspect, then apply with kubectl

helm install renders and applies the chart in one command. The cub path splits that into render, inspect, then apply. The live Redis comparison checks all 13 chart objects field-for-field, runs both deployments, and records PONG from each.

1 · Render

cub installer setup writes plain files under ./out/manifests. The reuse-existing-secret preset records the Secret name and key the target must supply; it does not put password material in the rendered OCI.

2 · Apply

kubectl apply installs those files. Create the namespace first so the objects land where you expect.

Same render, same working result, visible before apply.

The same render, side by side with plain Helm:

redis → redis

# before either install: provide the password separately
$ kubectl create namespace redis
$ kubectl -n redis create secret generic redis-existing-secret \
    --from-literal=redis-password="$(openssl rand -base64 32)"

# plain Helm with the preset's recorded values
$ helm install redis oci://registry-1.docker.io/bitnamicharts/redis \
    --version 25.5.3 -n redis \
    --set auth.existingSecret=redis-existing-secret \
    --set auth.existingSecretPasswordKey=redis-password \
    --set image.digest=sha256:6e7a020f1f6504698a7272c58783bdc2c23588c49febbae5aca1bb8dfa10af25

# or: render the reviewed package, write OCI, then apply
$ cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-redis:25.5.3@sha256:a216ce212424e05b341ef5000f1798e6014b72b8bc3dce9f315285871037af2a \
    --base reuse-existing-secret --namespace redis \
    --work-dir ./redis --non-interactive \
    --output-oci ./redis-rendered.oci
$ kubectl apply -f ./redis/out/manifests -n redis

Now deploy it, three ways

Runs on your laptop until the apply: pushing the rendered layout to a registry needs only registry credentials, not a ConfigHub account.

First, put the rendered bundle somewhere a controller can pull: flux push artifact oci://REGISTRY/redis-rendered:v1 --path ./redis/out/manifests --source local --revision v1 (or oras cp the local layout).

kubectl

kubectl apply -f ./redis/out/manifests/

Flux

apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata: { name: redis-rendered, namespace: flux-system }
spec:
  interval: 5m
  url: oci://REGISTRY/redis-rendered
  ref: { tag: v1 }
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata: { name: redis-rendered, namespace: flux-system }
spec:
  interval: 10m
  sourceRef: { kind: OCIRepository, name: redis-rendered }
  path: "."
  prune: true
  wait: true

Argo CD (3.x with OCI sources enabled)

Argo CD 2.x has no OCI source. On 2.x, pull the image with oras pull and commit the files to the repository Argo CD watches, or hand the image to Flux, whose OCIRepository reads it directly.

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata: { name: redis-rendered, namespace: argocd }
spec:
  project: default
  source:
    repoURL: oci://REGISTRY/redis-rendered
    targetRevision: v1
    path: .
  destination: { server: https://kubernetes.default.svc, namespace: redis }
  syncPolicy:
    syncOptions: [CreateNamespace=true]

Pruning and CRD ordering differ per path. The GitOps adopter guide has the tested details; the CRD ordering record shows the failure you avoid.

4. Change an image without signing in

When an OCI already contains exact Kubernetes objects, you can change one named field and create a checked replacement locally. This example changes only the NGINX replica count, and it runs from a checkout of the helm-expt repository, the project behind this site:

public OCI → checked local OCI

$ npm run oci:transform -- \
  oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/byo-nginx-ai-values@sha256:34af6a50b952d1a168a5cad614ef47f652cf44b11806a93bf6cc7a79c6e9c683 \
  --object Deployment/nginx --namespace nginx \
  --field spec.replicas --value 4 \
  --output oci-layout:./nginx-replicas-4:reviewed

The output contains the complete Kubernetes YAML, the input digest, the exact field change, and the check results. The command pulls the output back and compares it before reporting success. Existing source and change records are kept when the output is changed again.

Read the command guide · See the public NGINX proof

5. Check the record

Four receipts back this path, all anonymous. Flux reconciled the public nginx artifact and the workload reached ready, with no credential. A job with no ConfigHub login pulled the public package. Flux pulled a rendered output and the workload reached ready. Argo CD, Flux, and kubectl consumed one digest. The full manifests are on this page, above.

The live NGINX proof uses this installer output path with no ConfigHub token. Flux reconciled the exact output digest and the workload reached 1/1 ready replicas. The Redis comparison independently verifies a local rendered OCI and full Helm parity for the existing-Secret configuration.

source receipt -> object receipt -> delivery receipt -> runtime receipt

Each receipt proves one boundary. The runtime receipt reports what happened after delivery; it does not prove that the source or object set was correct.

6. Read the current limits

The chart's normal default carries password material in its rendered Secret. The catalog recommends reuse-existing-secret instead. That preset names the Secret the target must provide, and the rendered OCI contains no password.

kubectl does not wait for the namespace. Create the namespace first. A controller such as Argo or Flux can order this for you.

cub installer push publishes the multi-preset source package. Users pull that package with cub installer setup --pull. See every OCI shape and which consumer needs which layout.

A chart with hooks, admission webhooks, or its own CRDs needs more than a render. Its chart page says which lifecycle steps apply.

Plain kubectl apply does not infer CRD order or wait for CRDs to become established. See who owns each CRD and how the order is proved, and read the first-install CRD known gap before using a direct apply path.

Public catalog package refs are published in Google Artifact Registry with anonymous read access. No ConfigHub account or Google registry login is needed for the local setup path.

Open Get Started · Read the source guide

7. Do this next

Reconcile the published nginx component, or render any other chart and hand the output to the Flux or Argo CD you already run. When the result needs shared variants, approvals, or a fleet rollout, upload it into ConfigHub and release it by digest.

See the deploy manifests