1. Read the current delivery limits
| Problem | Severity | What it means, and what to do now | Fix or boundary | Evidence |
|---|---|---|---|---|
| Fixed placeholder credentials | Blocks production use of those renders | Some deterministic demo renders contain a fixed placeholder. A placeholder must never be presented as a generated production credential. The current check covers 12 selected defaults with known credential behavior, not the whole Catalog. Do now: Choose an existing-Secret configuration and supply your own Secret for real use. | Permanent boundary: a placeholder never becomes a credential. The existing-Secret bases are the fix. | Open evidence |
| cub-direct no prune | Plan around it | Plain apply does not remove an object when it disappears from the desired configuration. Do now: Enable and verify pruning in Argo CD or Flux, or delete the object explicitly during the upgrade. | Permanent boundary of plain apply. Argo CD and Flux pruning are the tested paths. | Open evidence |
| cub-direct CRD ordering | Plan around it | Kubernetes must establish a CRD before it can accept objects that use that CRD. Do now: Install and wait for the CRDs first, or use a tested Argo CD or Flux ordering path. | Permanent boundary of cub-direct. The ordered Argo CD and Flux paths are tested. | Open evidence |
| cub-scout drift field coverage | Treat results as partial | The current drift check finds changes to replicas and images, but it does not find every container environment-variable change. Do now: Treat the result as partial and inspect environment variables separately. | Being extended. Environment-variable coverage is open work. | Open evidence |
| SSA conflict ergonomics | Slows you down | Server-side apply reports a conflict instead of silently overwriting a manual live edit, but the resolution workflow is still awkward. Do now: Stop and choose whether the live or desired value should win. Record the decision before retrying. | Being improved. The conflict is correct; the resolution workflow is the work. | Open evidence |
| Helm-to-cub migration friction | Slows you down | cub safely rejects some normal Helm usage, but several error messages still do not explain the required change clearly. Do now: Use the migration guide. Keep using Helm for a case when the safe cub path is unclear. | Being improved, message by message. | Open evidence |
2. Check the exact chart and configuration
Open the chart page and find the configuration you plan to use. Follow any watch or blocked reason before you deploy it.
Prune protection means that a delivery path deliberately keeps an existing object when it disappears from the next configuration. It does not protect a field from being changed.
Use FAQ for a short answer. Use Broken Chart Triage when a render or install fails. Open the evidence link when you need the exact command and receipt.