New to cub? Install the cub CLI first. Public catalog packages pull and render anonymously, and you sign in only once a command saves or changes ConfigHub data.
1. What stays Kubara, and what ConfigHub adds
| Kubara stays | ConfigHub adds |
|---|---|
| Ordered catalogs, ServiceDefinitions, config.yaml, values overlays, generated platform files, hub/spoke intent | A base for each component and a variant for each cluster, holding each service as Kubara's hub delivers it, with the Workshop Catalog's evidence for each pinned chart version |
| Git as the portable platform hand-off | After handover, each cluster's approved release, served as OCI from ConfigHub; hand-back returns delivery to Git |
| Argo CD as the cluster reconciler | A rollout workflow for each component: stages in order, an approval before each release, and a Healthy gate that reads argobot's live status |
2. The current path: cub kubara
Today a Kubara platform comes into ConfigHub through cub kubara v0.5.2. plan and render run offline. apply.sh creates the bases, variants and rollout workflows, and handover.sh points Kubara's hub at each cluster's approved release. check judges each cluster, health included, and handback.sh returns the hub to Git.
Bring Kubara's managed add-ons into ConfigHub gives the commands, what each step changes, how to undo it, and the known limits. Its live evidence is the kind lab at commit 95d4b9c, with its Its logs are the recorded run, recorded hand-back, recorded run and catalog upgrade on Kubara v0.16 and recorded run with a second approver. It also has the recorded recovery after kubara bootstrap, recorded ConfigHub v0.8.0 run, recorded run with live status on the Release and recorded run with service accounts.. It has run on kind only. The benefits below come from the older, separate proof.
3. Benefits with explicit acceptance evidence
Each status pill reads one of three ways. A retained (historical) pill means the frozen four-cluster reference proof accepted the benefit for its recorded version; it is not current or live evidence, and some name the exact result, such as a passed performance gate or zero audited residue. A current deterministic pill means committed deterministic evidence accepts it, without a live run. Any other wording means the deterministic contract still holds while its live acceptance is absent, stale, or not yet accepted.
These retained runs used the earlier approval model. They do not prove the current ChangeWorkflow and Approval-attestation paths; those paths need fresh live receipts.
One gate remains open. Every benefit below was accepted in the project's own retired four-cluster organization. A clean import into a fresh organization that you choose has not run yet, and it is the gate that stands between these results and a claim about your platform.
| Benefit | Evidence or acceptance target | Status |
|---|---|---|
| No rewrite | 135 path-and-byte-identical generated files from Kubara's official and ConfigHub-aligned catalog lanes; 13 deterministic effective renders. | current deterministic |
| A stronger component Catalog | The Kubara catalog 1.1 coverage run closed at 103 components and 130 retained versions, with all 18 exact Kubara selections kept under additive-only retention. The Catalog has grown since; the pages above carry its current size of 112 components and 139 retained versions. | current deterministic |
| Recognizable platform shape | 4 clusters, 7 platform roles, 2 applications, faithful and adapted delivery identities, with Argo CD retained. | retained (historical) |
| Upgrade-safe retained workloads | 16 exact journaled immutable-selector replacements, including four PostgreSQL StatefulSets whose bound PVC identities are retained. | retained (historical) |
| Fleet visibility | 36 component/application cells, 25 curated native Link intents, and 663 extracted wiring facts kept as the full engineering view. | retained (historical) |
| Repeatable delivery | The retained four-cluster proof includes exact release heads, healthy applications, and an immediate zero-action apply. | retained (historical) |
| Measured reconciliation cost | The retained no-op made 0 ConfigHub mutation attempts and 0 Argo sync requests, while recording 33 ConfigHub CLI read commands, 208 total subprocess calls, and about 77 seconds. The fixture regression target is met; this is not a raw-Kubara comparison, HTTP-round-trip count, or service-level promise. | retained (historical): performance gate passed |
| Clean governed inventory | A separate audit must prove exact ConfigHub inventory, no Argo-prunable resources, and no unclassified, dangling, or UID-stale audited durable workloads. It does not claim a complete inventory of every Kubernetes type. | retained (historical): audited residue zero |
The status is generated from an exact evidence chain, component by component. The complete faithful, adapted, performance, matrix, wiring, orphan, and six-frame GUI chain is complete and consistent. It is frozen historical evidence: the Kubara v0.13 four-cluster hx-app-* reference organization, recorded in August 2026. That organization is retired and is not rerun, and its receipts predate the cub 0.4 field renames. The Catalog pins those receipts from confighub/kubara-confighub byte for byte in its evidence lock. The current live proof is the kind lab (examples/kind-lab/ in confighub/kubara-confighub v0.5.2, commit 95d4b9c). Its logs are the recorded run, recorded hand-back, recorded run and catalog upgrade on Kubara v0.16 and recorded run with a second approver. It also has the recorded recovery after kubara bootstrap, recorded ConfigHub v0.8.0 run, recorded run with live status on the Release and recorded run with service accounts. Missing or inconsistent faithful, source-digest mini-IDP, performance, matrix, wiring, orphan, or GUI evidence stays visible instead of becoming a green marketing claim.
4. The honest boundaries
- This is deterministic adoption, not an AI rewrite. Ordinary catalog and configuration updates may still be required.
- The user explicitly selects the organization. Targets and the local delivery runtime are current prerequisites; the importer does not silently create or guess them.
- Secrets and target-owned facts stay outside the portable Git and OCI payloads.
- Desired state, current live state, historical evidence, OCI publication, and production support remain distinct claims.
- The exact-digest evidence controls the managed automated path. Blocking privileged human or manual Argo sync additionally requires separate RBAC or admission proof.
- The retained no-op records 33 ConfigHub CLI read commands and 208 total subprocess calls. It completes in about 77 seconds, with zero ConfigHub mutation attempts and zero Argo sync requests. The fixture regression target is met. CLI commands are not HTTP round trips; this is not a raw-Kubara comparison or a service-level promise.
- The four-cluster organization was live-proved in August 2026 and is now retired; that proof is frozen historical evidence. A clean import into a fresh user-selected organization is still a separate graduation gate.
live receipt required means a deterministic contract exists but its current live acceptance chain is absent or stale.