ConfigHub Examples

This repo contains runnable examples for ConfigHub.

Safe First Checks

For a read-only first pass:

./scripts/verify.sh
cub context list --json
cub space list --json
cub target list --space "*" --json

If you are not logged in yet, run cub auth login before the cub commands.

Stable Paths

• promotion-demo-data: quickest no-cluster demo data for learning ConfigHub's App-Deployment-Target model and promotion flow.
• gitops-import: canonical Argo CD GitOps import example and docs companion.
• initiatives-demo: 5 compliance initiatives backed by Kyverno CEL policies, with sample Kubernetes units to evaluate.
• custom-workers: worker extension examples, including bridge, function, and policy workers.
• pilot-example-addons-manager: standalone generated operational app with Variant-first GUI, CLI sibling, production ConfigHub browser OAuth registration, and live-binding proof gates.
• cost-management-app: generated operational app with a real cost engine: org-wide waste findings priced from config data, then a finding-owned dry run, short-lived exact review, explicit execution confirmation, revision-verified mutation, and receipt. The reduction plane beside cost-estimator's enforcement plane.
• configboard: BI-style dashboards over the configuration in your organization — what version of what is where, which guardrails are failing, how many resources you manage, how long changes take to land. Read-only and seeds nothing. Dashboards are AppConfig/YAML units, so they carry revision history and promote like any other config, and every panel prints its equivalent cub command. Includes a 3-minute silent demo video and transcript.
• global-app: classic multi-service app example.
• helm-platform-components: platform component example for Helm-managed infrastructure.
• vm-fleet: VM fleet operations example.

Recommended Starting Points

• If you want to explore Initiatives and compliance workflows, start with initiatives-demo.
• If you want the quickest no-cluster path, start with promotion-demo-data.
• If you want to understand Generators as functions on config data, start with spring-platform, then move to cub-gen/examples/springboot-paas for the product path, including the Spring ConfigHub Initiative GUI proof.
• If you want GitOps import, start with gitops-import and the Official GitOps Import docs.
• If you want to see the state of an existing organization at a glance, start with configboard — it seeds nothing, and its demo video covers the six bundled dashboards in three minutes.
• If you want worker extensibility, start with custom-workers.
• If you want a classic multi-service example, use global-app.

Note on contract standard: EXAMPLE_CONTRACT_STANDARD.md

Companion Material

Some other examples

• Fleet guardrails that analyze config, record a verdict as data, and gate apply on it: sec-scanner (container CVEs), rbac-manager (RBAC hygiene), and cost-estimator (workload cloud cost); the cost reduction counterpart is cost-management-app.
• Agentic RBAC companion patterns: rbac-manager-for-agents, rbac-manager-over-redis, and redis-platform-with-rbac-guardrails
• Agent-driven fleet managers — each a cub-* CLI that manages one domain of Kubernetes config as data across a fleet of cluster-Spaces, siblings of rbac-manager-for-agents: workload-manager (workload security and reliability posture: security context, resources, probes, PDBs), namespace-manager (namespaces and their policy envelope: pod-security labels, default-deny NetworkPolicy, baseline RBAC), network-policy-manager (NetworkPolicy, reasoned about with the Namespaces, workloads, and Services it covers), scheduling-manager (workload placement: nodeSelector, tolerations, node affinity), autoscale-manager (autoscaling: HorizontalPodAutoscalers and KEDA ScaledObjects), observability-manager (observability posture: Prometheus ServiceMonitor coverage and telemetry sidecar injection), and eks-manager (AWS EKS clusters as Crossplane managed resources)
• Platform view builders — read the config data in a Space and project it into a different platform representation: k8s-to-score reads the Kubernetes resources in a Space and emits a Score workload spec per Deployment or StatefulSet (the inverse of score-k8s; read-only)
• Incubator and experimental paths: incubator/README.md
• App mutation and platform flow: spring-platform/springboot-platform-app-centric
• Standalone operational app shape: pilot-example-addons-manager

cub-scout remains useful as companion material and as a source of comparison fixtures:

• cub-scout examples index
• Apptique microservice examples