audit-fleet-conformance

Compare live Kubernetes state against ConfigHub-governed intent across clusters.

14|Updated Jan 17, 2026
One-click install
npx skills add https://github.com/confighub/cub-scout --skill audit-fleet-conformance
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: audit-fleet-conformance
Source: https://github.com/confighub/cub-scout/tree/main/skills/audit-fleet-conformance
Command: npx skills add https://github.com/confighub/cub-scout --skill audit-fleet-conformance

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audit fleet-wide conformance by determining whether live Kubernetes and GitOps-managed resources agree with their declared source-of-truth across multiple namespaces, clusters, and View scopes.

Core Features & Use Cases

  • Fleet-wide three-way conformance: Compare DRY/WET/LIVE per resource to produce an agreement rollup for the entire scope.
  • Strategy-typed source-truth verdicts: Evaluate outcomes using declared governance strategies (e.g., Git/Argo expectations) with PASS/WATCH/BLOCK/ASK-style evidence quality.
  • Cross-cluster outlier detection: Flag clusters whose data for a View diverges from fleet expectations.
  • Evidence persistence via receipts: Optionally save receipt evidence for audit trails and compliance dashboards.

Quick Start

Use audit-fleet-conformance to compare every resource in View monthly-spend-by-team across your prod fleet and identify which resources are diverged, outliers, or reconciling.

Frequently Asked Questions about audit-fleet-conformance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Kubernetes fleet drift across multiple clusters?

You can audit Kubernetes fleet drift by running a three-way comparison of DRY, WET, and LIVE states per resource to produce an agreement rollup. This identifies which resources diverge from their declared source-of-truth across your fleet.

What is the best way to detect GitOps conformance drift for compliance audits?

GitOps conformance drift is detected by evaluating live Kubernetes resources against ConfigHub-governed intent using strategy-typed source-truth verdicts. This generates PASS, WATCH, or BLOCK evidence quality outcomes suitable for compliance audits.

How does fleet outlier detection work for Kubernetes resources?

Fleet outlier detection works by flagging clusters whose data for a specific View scope diverges from fleet expectations. It compares live state against source-of-truth across multiple namespaces to surface non-compliant clusters.

Can I save receipt evidence for Kubernetes compliance audit trails?

Yes, you can optionally save receipt evidence during a fleet conformance audit. This persists three-way comparison results and strategy-typed verdicts to provide an immutable audit trail for compliance dashboards.

Do I need connected mode to resolve View scopes for fleet conformance checks?

Yes, connected mode is required for View resolution, source-truth evaluation, and fleet outlier reporting. The audit must compose three-way comparisons with strategy checks, which depends on connected ConfigHub integration.

Can I use this for release gating before deploying GitOps controllers?

Yes, fleet conformance audits support release gating by evaluating whether live Kubernetes resources agree with declared governance strategies. This ensures resources are reconciled and compliant before proceeding with deployments.