A Helm chart you can't read becomes objects you can.
Before and after
Before: the Helm chart
{{- if .Values.controller.shareProcessNamespace }}
shareProcessNamespace: {{ .Values.controller.shareProcessNamespace }}{{- end }}
containers:
- name: {{ .Values.controller.containerName }}{{- with (merge .Values.controller.image .Values.global.image) }}
image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ include "ingress-nginx.image" . }}{{ end }}:{{ .tag }}{{ include "ingress-nginx.imageDigest" . }}{{- end }}
imagePullPolicy: {{ .Values.controller.image.pullPolicy }}{{- if .Values.controller.lifecycle }}
lifecycle: {{ toYaml .Values.controller.lifecycle | nindent 12 }}{{- end }}
args: {{ include "ingress-nginx.params" . | nindent 12 }}
securityContext: {{ include "ingress-nginx.controller.containerSecurityContext" . | nindent 12 }}
env:
- name: POD_NAME
16 lines of templates/controller-deployment.yaml, around its image line. The chart has many files like this.
After: in ConfigHub
The same image line in ConfigHub, as a plain value. Taken in the helm-catalog organization on 2026-10-25, showing the ingress-nginx controller Deployment, at its image line.
ConfigHub holds this as 13 Units, one for each of the 12 objects the installer writes and one installer record.
In ConfigHub: one base, and a variant for each environment
Prod's panel lists what prod changes from the base, here its label and three replicas of the controller. Taken in the helm-catalog organization on 2026-10-26, showing the ingress-nginx base with its dev and prod variants, and the label and three replicas prod sets on the controller.
The template's image line becomes one plain value you can read, and so does every other field.
The 7 setup objects Helm runs out of sight become steps you can read.
Every object is written out, so you can review it before anything runs.
What Helm does that you never see, and what happens here instead
What Helm does
What happens here instead
Runs two short-lived Jobs while installing. The first makes a TLS certificate for the admission webhook, and the second hands that certificate to the webhook.
Nothing runs out of sight. The certificate, the Secret ingress-nginx/ingress-nginx-admission, must exist before delivery.Show me
What Helm runs, and when
ServiceAccount ingress-nginx-admission: before installing, before upgrading, after installing, after upgrading
ClusterRole ingress-nginx-admission: before installing, before upgrading, after installing, after upgrading
ClusterRoleBinding ingress-nginx-admission: before installing, before upgrading, after installing, after upgrading
Role ingress-nginx-admission: before installing, before upgrading, after installing, after upgrading
RoleBinding ingress-nginx-admission: before installing, before upgrading, after installing, after upgrading
Job ingress-nginx-admission-create: before installing, before upgrading
Job ingress-nginx-admission-patch: after installing, after upgrading
ConfigHub keeps configuration as plain objects, with a history of every change. Loading puts this chart's objects in a Space, a folder in your ConfigHub organization.
Load it into your ConfigHub
Sign in with the first line, then paste the rest. It fetches the ingress-nginx package, writes its files, and saves them as a Space called ingress-nginx-example in your organization. The rest makes a dev and a prod variant of it, and prod runs three replicas of the controller. It touches no cluster.
$ cub auth login
$ cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/ingress-nginx-ingress-nginx:4.15.1@sha256:dc0f6c1a8158230957c1cae1b26073339b009b220c79cff0e3df31e9f21c73e4 --base default --work-dir ./ingress-nginx-example --non-interactive --namespace ingress-nginx && cub installer upload --work-dir ./ingress-nginx-example --space ingress-nginx-example && cub component create ingress-nginx-example && cub space update --patch ingress-nginx-example --component ingress-nginx-example
$ cub variant create dev ingress-nginx-example --change-desc "Clone the base as dev"
$ cub variant create prod ingress-nginx-example --change-desc "Clone the base as prod"
$ cub function set --space ingress-nginx-example-dev --change-desc "Label every object environment dev" set-label environment dev
$ cub function set --space ingress-nginx-example-prod --change-desc "Label every object environment prod" set-label environment prod
$ cub function set --space ingress-nginx-example-prod --unit deployment-ingress-nginx-ingress-nginx-controller --change-desc "Run three replicas in prod" set-replicas 3
No account needed. This fetches the ingress-nginx package and writes every object into a folder you can open. To check your own chart and values instead, see Is my configuration right?
