Serverless mode

Run it without ConfigHub Server

This example is both serverless and anonymous: it uses neither ConfigHub Server nor a ConfigHub account. You can inspect the rendered objects and prerequisites, then keep them as files, apply them yourself, or write the non-secret objects to OCI.

kindany clusterno ConfigHub account
redis → redis
# before either lane: provide the password separately
$ kubectl create namespace redis
$ kubectl -n redis create secret generic redis-existing-secret \
    --from-literal=redis-password="$(openssl rand -base64 32)"

# plain Helm with the preset's recorded values
$ helm install redis oci://registry-1.docker.io/bitnamicharts/redis \
    --version 25.5.3 -n redis \
    --set auth.existingSecret=redis-existing-secret \
    --set auth.existingSecretPasswordKey=redis-password \
    --set image.digest=sha256:6e7a020f1f6504698a7272c58783bdc2c23588c49febbae5aca1bb8dfa10af25

# or: render the reviewed package, write OCI, then apply
$ cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-redis:25.5.3 \
    --base reuse-existing-secret --namespace redis \
    --work-dir ./out --non-interactive \
    --output-oci ./redis-rendered.oci
$ kubectl apply -f ./out/manifests -n redis

The preset's rendered objects have a committed Helm-equivalence receipt. Run the Helm and cub lanes on separate throwaway clusters when you want to compare the live result.

What is --pull?

It points cub at an installer package: a reviewed chart/version with bases, recorded inputs, rendered objects, and proof links. For public catalog charts, use the package's oci:// ref after the chart page shows a publication receipt. cub pulls that package into the work directory, then writes out/spec and out/manifests. In this repo, maintainers may also use the local packages/... source path while a ref is still marked assigned.

Public catalog package refs are published in Google Artifact Registry with anonymous read access. No ConfigHub account or Google registry login is needed for the local setup path.

Where the no-account tools fit

You can use them before an OCI package is built, after you pull one, or between an input package and an output package.

work -> OCI

Inspect and test a chart, recipe, installer package, or set of Kubernetes files, then build an OCI package.

OCI -> work

Pull a public OCI package to inspect its objects, run checks, or compare it with another version.

OCI -> work -> OCI

Pull a package, test or edit the exact objects, and build a new package. Registry publication is a separate authenticated step.

Here, work means inspect, explain, test, scan, compare, or edit. It can run as a local command or in CI today. A public hosted service that can do this work without signing in is planned, but not yet shipped.

Change an existing OCI without signing in

When an OCI already contains exact Kubernetes objects, you can change one named field and create a checked replacement locally. This example changes only the NGINX replica count:

public OCI → checked local OCI
$ npm run oci:transform -- \
  oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/byo-nginx-ai-values@sha256:34af6a50b952d1a168a5cad614ef47f652cf44b11806a93bf6cc7a79c6e9c683 \
  --object Deployment/nginx --namespace nginx \
  --field spec.replicas --value 4 \
  --output oci-layout:./nginx-replicas-4:reviewed

The output contains the complete Kubernetes YAML, the input digest, the exact field change, and the check results. The command pulls the output back and compares it before reporting success. Existing source and change records are kept when the output is changed again.

Read the command guide · See the public NGINX proof

Helm hides one step. cub shows it.

helm install renders and applies the chart in one command. The cub path splits that into render, inspect, then apply. The live Redis comparison checks all 13 chart objects field-for-field, runs both deployments, and records PONG from each.

1 · Render

cub installer setup writes plain files under ./out/manifests. The reuse-existing-secret preset records the Secret name and key the target must supply; it does not put password material in the rendered OCI.

2 · Apply

kubectl apply installs those files. Create the namespace first so the objects land where you expect.

Same render, same working result, visible before apply.

The other delivery: GitOps via OCI

Already running Argo CD or Flux from an OCI registry? Give --output-oci a registry reference. The installer pushes the non-secret objects, reads the artifact back, and checks the object-set digest before returning.

redis → OCI

New to cub? Install the cub CLI first. You can pull and render public catalog packages without an account. Commands that save or change ConfigHub data require you to sign in.

What this command does. cub installer is a released, open-source plugin for the cub CLI. cub installer setup pulls a catalog package and writes its Kubernetes files locally. It does not apply those files to a cluster; use kubectl, Argo CD, or Flux for delivery. The generated scripts stop before doing any work when the plugin or kustomize is missing.

$ cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-redis:25.5.3 \
    --base reuse-existing-secret --namespace redis \
    --work-dir ./out --non-interactive \
    --output-oci oci://<your-registry>/redis:v1
$ flux create source oci redis --url=oci://<your-registry>/redis --tag=v1 --interval=30s
$ flux create kustomization redis --source=OCIRepository/redis --path=./ --prune=true

The live NGINX proof uses this installer output path with no ConfigHub token. Flux reconciled the exact output digest and the workload reached 1/1 ready replicas. The Redis comparison independently verifies a local rendered OCI and full Helm parity for the existing-Secret configuration.

The edges, kept in plain sight

The chart's normal default carries password material in its rendered Secret. The catalog recommends reuse-existing-secret instead. That preset names the Secret the target must provide, and the rendered OCI contains no password.

kubectl does not wait for the namespace. Create the namespace first. A controller such as Argo or Flux can order this for you.

cub installer push publishes the multi-preset source package. Users pull that package with cub installer setup --pull. The separate --output-oci artifact contains one selected preset's exact non-secret Kubernetes objects for Argo CD, Flux, or another OCI consumer.

A chart with hooks, admission webhooks, or its own CRDs needs more than a render. Its chart page says which lifecycle steps apply.

Open Get Started · Read the source guide