audit-fleet-conformance

Compare live Kubernetes state against ConfigHub-governed intent across clusters.

14|Updated Jan 17, 2026
One-click install
npx skills add https://github.com/confighub/cub-scout --skill audit-fleet-conformance
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-fleet-conformance
Source: https://github.com/confighub/cub-scout/tree/main/skills/audit-fleet-conformance
Command: npx skills add https://github.com/confighub/cub-scout --skill audit-fleet-conformance

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audit fleet-wide conformance by determining whether live Kubernetes and GitOps-managed resources agree with their declared source-of-truth across multiple namespaces, clusters, and View scopes.

Core Features & Use Cases

  • Fleet-wide three-way conformance: Compare DRY/WET/LIVE per resource to produce an agreement rollup for the entire scope.
  • Strategy-typed source-truth verdicts: Evaluate outcomes using declared governance strategies (e.g., Git/Argo expectations) with PASS/WATCH/BLOCK/ASK-style evidence quality.
  • Cross-cluster outlier detection: Flag clusters whose data for a View diverges from fleet expectations.
  • Evidence persistence via receipts: Optionally save receipt evidence for audit trails and compliance dashboards.

Quick Start

Use audit-fleet-conformance to compare every resource in View monthly-spend-by-team across your prod fleet and identify which resources are diverged, outliers, or reconciling.

Frequently Asked Questions about audit-fleet-conformance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Kubernetes fleet drift across multiple clusters?▼

You can audit Kubernetes fleet drift by running a three-way comparison of DRY, WET, and LIVE states per resource to produce an agreement rollup. This identifies which resources diverge from their declared source-of-truth across your fleet.

What is the best way to detect GitOps conformance drift for compliance audits?▼

GitOps conformance drift is detected by evaluating live Kubernetes resources against ConfigHub-governed intent using strategy-typed source-truth verdicts. This generates PASS, WATCH, or BLOCK evidence quality outcomes suitable for compliance audits.

How does fleet outlier detection work for Kubernetes resources?▼

Fleet outlier detection works by flagging clusters whose data for a specific View scope diverges from fleet expectations. It compares live state against source-of-truth across multiple namespaces to surface non-compliant clusters.

Can I save receipt evidence for Kubernetes compliance audit trails?▼

Yes, you can optionally save receipt evidence during a fleet conformance audit. This persists three-way comparison results and strategy-typed verdicts to provide an immutable audit trail for compliance dashboards.

Do I need connected mode to resolve View scopes for fleet conformance checks?▼

Yes, connected mode is required for View resolution, source-truth evaluation, and fleet outlier reporting. The audit must compose three-way comparisons with strategy checks, which depends on connected ConfigHub integration.

Can I use this for release gating before deploying GitOps controllers?▼

Yes, fleet conformance audits support release gating by evaluating whether live Kubernetes resources agree with declared governance strategies. This ensures resources are reconciled and compliant before proceeding with deployments.