Skip to content

ConfigHub Enterprise Product Description

Edition: 2026-09-04
Permanent URL: https://docs.confighub.com/enterprise/product-description/2026-09-04/
Current edition: https://docs.confighub.com/enterprise/product-description/

This document describes what ConfigHub Enterprise is, how it is delivered, and what a subscription includes. When it is attached to a customer agreement, the edition dated in the agreement governs.

1. What ConfigHub Enterprise is

ConfigHub Enterprise is a customer-hosted software service that acts as the operational source of truth for software deployment configuration. It stores configuration as structured data, validates and governs changes to it, and delivers the result to Kubernetes clusters and cloud platforms through GitOps controllers and other agents. Customers run it inside their own environment. ConfigHub, Inc. does not host it and therefore does not host any customer data.

Core capabilities:

  • A centralized configuration-as-data store with a queryable graph of spaces, targets, units, revisions, and their relationships.
  • Post-render inspection of the manifests that will actually be applied, including drift detection and blast-radius calculation before a change is applied.
  • Policy evaluation and change workflows, producing audit records of every change.
  • Integration with GitOps deployment controllers, including Argo CD and Flux, and with source platforms such as GitHub.
  • Identity integration with the customer's identity provider over OpenID Connect or SAML, with role-based access control.

2. Components

ConfigHub Enterprise has two kinds of components. The distinction matters for licensing, maintenance, and intellectual property concerns.

2.1 Commercial Software

The Commercial Software is ConfigHub Enterprise itself: the ConfigHub server, the web user interface, and every other component distributed as part of the ConfigHub Enterprise container image, published at ghcr.io/confighubai/confighub. It is licensed under a commercial agreement. It is not open source.

The Commercial Software includes every update, fix, enhancement, and new version of these components released during a subscription, whoever requested or funded the work. Functionality that ConfigHub adds to the server, the user interface, or the image is part of the Commercial Software from the moment it is released.

2.2 Open Source Components

ConfigHub publishes the client-side and extension parts of the software as open source under the MIT License at github.com/confighub. The Open Source Components covered by ConfigHub Enterprise support are:

  • github.com/confighub/sdk: the cub command-line interface, the Go client library, the OpenAPI specification, and the SDK for extending ConfigHub with functions and integrations.
  • github.com/confighub/argobot: the bot that synchronizes Argo CD applications from ConfigHub events.

Anyone may use, modify, and redistribute the Open Source Components under the MIT License, with or without a ConfigHub subscription. ConfigHub develops them in public, and fixes and enhancements to them are released publicly under the MIT License. A ConfigHub Enterprise subscription adds maintenance and support for them. It does not change their license.

Other repositories under github.com/confighub are open source but are not part of ConfigHub Enterprise and are not covered by support unless listed above.

2.3 Required components not included

ConfigHub Enterprise runs on infrastructure and third-party software that the customer provides and operates. These are required for the software to function but are not part of ConfigHub Enterprise, are not licensed by ConfigHub, and are not covered by ConfigHub maintenance or support:

  • A Kubernetes cluster to run the Commercial Software.
  • A PostgreSQL database. ConfigHub Enterprise stores all of its data in a customer-managed PostgreSQL instance, for example Amazon RDS. The customer owns the data, the backups, and the encryption at rest.
  • Keycloak, for identity provider integration. ConfigHub Enterprise brokers single sign-on through a Keycloak instance, which federates to the customer's own identity provider over OpenID Connect or SAML. Keycloak is open source software from a third party (Apache License 2.0) and the customer operates it. An evaluation install can run without it, using a local administrator account.
  • An ingress controller and TLS certificates for the ConfigHub endpoints.
  • Network access to a container registry to pull the Commercial Software image, either ghcr.io/confighubai/confighub directly or a mirror the customer maintains.

For convenience, ConfigHub's installation tooling can deploy PostgreSQL and Keycloak into the cluster from their upstream images, or connect to instances the customer already runs. Customers run the upstream Keycloak image; ConfigHub does not distribute its own Keycloak build. Either way they remain third-party software under their own licenses. Each Commercial Software release states the versions of these components it is tested against.

3. Delivery and deployment

  • The Commercial Software is delivered as a container image. The customer pulls the image from ghcr.io/confighubai/confighub. The image is publicly downloadable; no registry credentials are required. The image carries its own license terms: absent a commercial agreement, use is governed by the ConfigHub Evaluation License included in the image, which limits use to internal evaluation by design partners under NDA. A signed commercial agreement controls over the Evaluation License.
  • The Open Source Components are delivered through their public GitHub releases.
  • The customer deploys ConfigHub Enterprise in its own environment, for example a private AWS VPC, together with the required components in section 2.3. The customer operates the deployment, holds the data, and controls network access and encryption.
  • ConfigHub also operates a multi-tenant SaaS service at confighub.com. That service is a separate product under its own terms and is not part of ConfigHub Enterprise.

4. What a ConfigHub Enterprise subscription is

A ConfigHub Enterprise subscription is a term license to the Commercial Software, together with maintenance and support for the Commercial Software and for the Open Source Components listed in section 2.2. The scope of maintenance, the support level, and any response commitments are set out in the customer's agreement. Fixes and enhancements to the Open Source Components are released publicly under the MIT License; a subscription does not create private versions of them.

5. What a subscription does not include

  • Professional services, custom software development, or bespoke integrations. These are delivered under a separate statement of work.
  • Separately packaged ConfigHub products, meaning software that ConfigHub releases as its own product rather than as part of the ConfigHub Enterprise image or the listed Open Source Components.
  • The ConfigHub SaaS service.
  • The required components listed in section 2.3: the Kubernetes cluster, PostgreSQL, Keycloak, ingress and TLS, and their operation. Hosting and infrastructure costs are the customer's.

6. Versioning

  • The Commercial Software follows semantic versioning.
  • The Open Source Components are versioned independently. Each Commercial Software release states the compatible versions of the Open Source Components.
  • Any version starting with 0, (for example v0.1.1) makes no commitments to backwards compatibility or interface stability of any kind.

7. Third-party and open source content of the Commercial Software

The Commercial Software incorporates third-party open source components. The notices and full license texts ship inside the container image, so an inventory is available to anyone who has pulled it:

  • /srv/app/THIRD_PARTY_LICENSES.txt: the Go modules linked into the server binary, with license type and source location for each.
  • /srv/app/UI_THIRD_PARTY_LICENSES.txt: the npm packages bundled into the embedded web UI.
  • /srv/app/OS_LICENSE_NOTICE.txt: the operating-system packages in the Alpine base image, including a written offer of corresponding source for GPL-licensed packages.

Application-level dependencies, meaning the Go modules and npm packages, are under permissive licenses such as MIT, BSD, Apache 2.0, and ISC, with the exception of a small number of Go modules under the Mozilla Public License 2.0, which are used unmodified. The operating-system layer consists of standard Alpine packages, some under the GNU General Public License, distributed unmodified as separate programs alongside the ConfigHub software. ConfigHub's own code does not incorporate copyleft-licensed code.

Editions

Each edition has a permanent URL. Customer agreements cite the Product Description by edition date.