observe-confighub-managed

Detect ConfigHub ownership and delivery path for Kubernetes resources.

14|Updated Jan 17, 2026
One-click install
npx skills add https://github.com/confighub/cub-scout --skill observe-confighub-managed
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: observe-confighub-managed
Source: https://github.com/confighub/cub-scout/tree/main/skills/observe-confighub-managed
Command: npx skills add https://github.com/confighub/cub-scout --skill observe-confighub-managed

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It resolves ownership and attribution confusion for Kubernetes resources that are delivered by Argo or Flux but whose desired state originates in ConfigHub.

Core Features & Use Cases

  • ConfigHub-first ownership detection: Classifies resources as ConfigHub-owned using confighub.com/UnitSlug label or annotation, even when Argo/Flux labels are also present.
  • Delivery-path attribution: Explains whether the resource was delivered via ConfigHub-via-Argo (argocd.argoproj.io/instance) or ConfigHub-via-Flux (Kustomization/HelmRelease labels).
  • Connected-mode enrichment: When authenticated to ConfigHub, adds ConfigHub deep-links, incoming bindings, and DRY/WET/LIVE comparison evidence for ConfigHub revisions.

Quick Start

Use observe-confighub-managed to explain a live Deployment and identify the ConfigHub Unit and delivery mechanism behind it.

Frequently Asked Questions about observe-confighub-managed

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I determine if a live Kubernetes resource is managed by ConfigHub?

ConfigHub ownership is determined by detecting the confighub.com/UnitSlug label or annotation on live Kubernetes resources, classifying them as ConfigHub-owned even when Argo CD or Flux labels are also present.

Can I trace a Kubernetes deployment back to its specific ConfigHub Unit and revision?

Yes, you can trace a Kubernetes deployment back to its ConfigHub Unit by using connected-mode enrichment via cub auth login, which adds deep-links, incoming bindings, and DRY/WET/LIVE comparison evidence for ConfigHub revisions.

How does ConfigHub attribution work when both ConfigHub and Argo CD labels exist on a resource?

ConfigHub-first ownership detection prioritizes the confighub.com/UnitSlug label over Argo CD or Flux labels, disambiguating the delivery path to explain whether the resource was delivered via ConfigHub-via-Argo or ConfigHub-via-Flux.

What's the best way to troubleshoot which ConfigHub Space produced a live Kubernetes resource?

The best way to troubleshoot ConfigHub Space attribution is to inspect the resource's confighub.com/UnitSlug label and use connected-mode enrichment to retrieve incoming bindings and DRY/WET/LIVE comparison evidence tied to the ConfigHub revision.

Do I need to authenticate to ConfigHub to trace resource ownership?

Basic ownership detection works without authentication by reading labels and annotations, but authenticating via cub auth login enables connected-mode enrichment with deep-links, incoming bindings, and DRY/WET/LIVE revision comparison evidence.