New to cub? Install the cub CLI first. Public catalog packages pull and render anonymously, and you sign in only once a command saves or changes ConfigHub data.
1. Read the current delivery limits
| Problem | Severity | What it means, and what to do now | Fix or boundary | Evidence |
|---|---|---|---|---|
| Fixed placeholder credentials | Blocks production use of those renders | Some deterministic demo renders contain a fixed placeholder. A placeholder must never be presented as a generated production credential. The current check covers 12 selected defaults with known credential behavior, not the whole Catalog. Do now: Choose an existing-Secret configuration and supply your own Secret for real use. | Permanent boundary: a placeholder never becomes a credential. The existing-Secret bases are the fix. | Open evidence |
| cub-direct no prune | Plan around it | Plain apply does not remove an object when it disappears from the desired configuration. Do now: Enable and verify pruning in Argo CD or Flux, or delete the object explicitly during the upgrade. | Permanent boundary of plain apply. Argo CD and Flux pruning are the tested paths. | Open evidence |
| cub-direct CRD ordering | Plan around it | Kubernetes must establish a CRD before it can accept objects that use that CRD. Do now: Install and wait for the CRDs first, or use a tested Argo CD or Flux ordering path. | Permanent boundary of cub-direct. The ordered Argo CD and Flux paths are tested. | Open evidence |
| cub-scout drift field coverage | Treat results as partial | The current drift check finds changes to replicas and images, but it does not find every container environment-variable change. Do now: Treat the result as partial and inspect environment variables separately. | Being extended. Environment-variable coverage is open work. | Open evidence |
| SSA conflict ergonomics | Slows you down | Server-side apply reports a conflict instead of silently overwriting a manual live edit, but the resolution workflow is still awkward. Do now: Stop and choose whether the live or desired value should win. Record the decision before retrying. | Being improved. The conflict is correct; the resolution workflow is the work. | Open evidence |
| Helm-to-cub migration friction | Slows you down | cub safely rejects some normal Helm usage, but several error messages still do not explain the required change clearly. Do now: Use the migration guide. Keep using Helm for a case when the safe cub path is unclear. | Being improved, message by message. | Open evidence |
Rendering for Flux, Argo CD, or kubectl
The chart's normal default carries password material in its rendered Secret. The catalog recommends reuse-existing-secret instead. That preset names the Secret the target must provide, and the rendered OCI contains no password.
kubectl does not wait for the namespace. Create the namespace first. A controller such as Argo or Flux can order this for you.
Here is what the command does. cub installer is an open-source plugin for the cub CLI. cub installer setup pulls a catalog package and writes its Kubernetes files locally, leaving delivery to kubectl, Argo CD or Flux. The generated scripts stop before doing any work when the plugin or kustomize is missing.
cub installer push publishes the multi-preset source package. Users pull that package with cub installer setup --pull. See every OCI shape and which consumer needs which layout.
A chart with hooks, admission webhooks, or its own CRDs needs more than a render. Its chart page says which lifecycle steps apply.
Plain kubectl apply does not infer CRD order or wait for CRDs to become established. See who owns each CRD and how the order is proved, and read the first-install CRD known gap before using a direct apply path.
Public catalog package refs are published in Google Artifact Registry with anonymous read access. No ConfigHub account or Google registry login is needed for the local setup path.
2. Check the exact chart and configuration
Open the chart page and find the configuration you plan to use. Follow any watch or blocked reason before you deploy it.
Prune protection means that a delivery path deliberately keeps an existing object when it disappears from the next configuration. It does not protect a field from being changed.
Use FAQ for a short answer. Use Broken Chart Triage when a render or install fails. Open the evidence link when you need the exact command and receipt.