chart-test-swarm — --dry-run

Time (UTC)
2026-06-02 10:54:33+00:00
Project
sample-product-chart
Chart
sample-product:0.1.0
Suite
nightly-full
Cluster
kind · k8s v1.30.0
Agents
2
UNTESTED · 59

Mechanism coverage

Worst status across all scenarios that exercise each mechanism. Covers: addons (cert-manager, istio, gatekeeper, …), subchart variants, customer profiles.

addon

subchart

mesh

customer

other

Scenarios

One row per scenario. Cell value: passed / total asserts. Groups with 3+ variants per integration are collapsed — click the header to expand.

Scenario Cluster shape Tags Asserts Status Agent
customer-b-gatekeeper
Customer B — OPA Gatekeeper admission policies
 kind
+ gatekeeper
 nightlycustomer-replica 0/0 UNTESTED —
minimal
Vanilla cluster — no preinstalled addons
 kind pr-subsetnightly 0/0 UNTESTED —
subchart-postgres-internal
Internal postgres subchart enabled
 kind pr-subsetnightly 0/0 UNTESTED —
UNTESTED 6 variants: 6 UNTESTED addon/cert-manager
Scenario Cluster shape Tags Asserts Status Agent
certificates-cert-manager-jks-pkcs12
cert-manager JKS/PKCS12 keystore bundle
 kind
+ cert-manager
 nightly 0/0 UNTESTED —
certificates-cert-manager-lets-encrypt-staging
cert-manager Let's Encrypt staging issuer
 kind
+ cert-manager
 nightly 0/0 UNTESTED —
certificates-cert-manager-self-signed-ca
cert-manager self-signed CA issuer
 kind
+ cert-manager
 nightly 0/0 UNTESTED —
certificates-cert-manager-wildcard
cert-manager wildcard certificate
 kind
+ cert-manager
 nightly 0/0 UNTESTED —
ingress-controllers-nginx-ingress-tls-cert-manager
NGINX Ingress TLS with cert-manager
 kind
+ cert-manager, ingress-nginx
 nightly 0/0 UNTESTED —
with-cert-manager
Customer ships cert-manager preinstalled
 kind
+ cert-manager
 pr-subsetnightly 0/0 UNTESTED —
UNTESTED 6 variants: 6 UNTESTED addon/contour
Scenario Cluster shape Tags Asserts Status Agent
gateway-api-contour-gateway-api-basic
Contour Gateway API Basic
 kind nightly 0/0 UNTESTED —
gateway-api-contour-gateway-api-response-header-modifier
Contour Gateway API Response Header Modifier
 kind nightly 0/0 UNTESTED —
gateway-api-contour-gateway-api-route-precedence
Contour Gateway API Route Precedence
 kind nightly 0/0 UNTESTED —
ingress-controllers-contour-basic-httpproxy
Contour basic HTTPProxy
 kind
+ contour
 nightly 0/0 UNTESTED —
ingress-controllers-contour-rate-limit
Contour rate limit
 kind
+ contour
 nightly 0/0 UNTESTED —
ingress-controllers-contour-tls-delegation
Contour TLS delegation
 kind
+ contour
 nightly 0/0 UNTESTED —
UNTESTED 5 variants: 5 UNTESTED addon/envoy-gateway
Scenario Cluster shape Tags Asserts Status Agent
envoy-gateway
Envoy Gateway (Gateway API)
 kind
+ envoy-gateway
 nightly 0/0 UNTESTED —
gateway-api-envoy-gateway-cert-manager-tls
Envoy Gateway + cert-manager TLS
 kind
+ envoy-gateway, cert-manager
 nightly 0/0 UNTESTED —
gateway-api-envoy-gateway-grpcroute
Envoy Gateway GRPCRoute
 kind
+ envoy-gateway
 nightly 0/0 UNTESTED —
gateway-api-envoy-gateway-httproute
Envoy Gateway HTTPRoute
 kind
+ envoy-gateway
 nightly 0/0 UNTESTED —
gateway-api-envoy-gateway-security-policy-attach
Envoy Gateway SecurityPolicy (CORS)
 kind
+ envoy-gateway
 nightly 0/0 UNTESTED —
UNTESTED 13 variants: 13 UNTESTED addon/istio
Scenario Cluster shape Tags Asserts Status Agent
customer-a-istio
Customer A — Istio mesh + cert-manager
 kind
+ cert-manager, istio-base, istiod
 nightlycustomer-replica 0/0 UNTESTED —
gateway-api-istio-gateway-api-backend-tls-policy
Istio Gateway API BackendTLSPolicy
 kind
+ istio-base, istiod
 nightly 0/0 UNTESTED —
gateway-api-istio-gateway-api-basic
Istio Gateway API Basic
 kind
+ istio-base, istiod
 nightly 0/0 UNTESTED —
gateway-api-istio-gateway-api-multi-listener
Istio Gateway API Multi-Listener
 kind
+ istio-base, istiod
 nightly 0/0 UNTESTED —
service-mesh-istio-ingress-gateway-basic
Istio Ingress Gateway — Basic
 kind
+ istio-base, istiod, istio-ingressgateway
 nightly 0/0 UNTESTED —
service-mesh-istio-ingress-gateway-jwt
Istio Ingress Gateway — JWT Authentication
 kind
+ istio-base, istiod, istio-ingressgateway
 nightly 0/0 UNTESTED —
service-mesh-istio-ingress-gateway-multi-host
Istio Ingress Gateway — Multi-Host
 kind
+ istio-base, istiod, istio-ingressgateway
 nightly 0/0 UNTESTED —
service-mesh-istio-ingress-gateway-request-authentication
Istio Ingress Gateway — RequestAuthentication (No Deny)
 kind
+ istio-base, istiod, istio-ingressgateway
 nightly 0/0 UNTESTED —
service-mesh-istio-service-mesh-cert-manager-tls
Istio Service Mesh + cert-manager TLS Gateway
 kind
+ cert-manager, istio-base, istiod, istio-ingressgateway
 nightly 0/0 UNTESTED —
service-mesh-istio-service-mesh-peer-authentication
Istio Service Mesh — PeerAuthentication lifecycle
 kind
+ istio-base, istiod
 nightly 0/0 UNTESTED —
service-mesh-istio-service-mesh-sidecar-injection
Istio Service Mesh — Sidecar Injection
 kind
+ istio-base, istiod
 nightly 0/0 UNTESTED —
service-mesh-istio-service-mesh-strict-mtls
Istio Service Mesh — strict mTLS
 kind
+ istio-base, istiod
 nightly 0/0 UNTESTED —
service-mesh-istio-service-mesh-telemetry-v2
Istio Service Mesh — Telemetry v2
 kind
+ istio-base, istiod
 nightly 0/0 UNTESTED —
UNTESTED 4 variants: 4 UNTESTED addon/kyverno
Scenario Cluster shape Tags Asserts Status Agent
policy-kyverno-generate
Kyverno generate: ConfigMap in labeled namespaces
 kind
+ kyverno
 nightly 0/0 UNTESTED —
policy-kyverno-image-verify
Kyverno image-verify: only approved registries
 kind
+ kyverno
 nightly 0/0 UNTESTED —
policy-kyverno-mutate
Kyverno mutate: auto-add annotation to Pods
 kind
+ kyverno
 nightly 0/0 UNTESTED —
policy-kyverno-validate
Kyverno validate: require labels on Deployments
 kind
+ kyverno
 nightly 0/0 UNTESTED —
UNTESTED 4 variants: 4 UNTESTED addon/linkerd
Scenario Cluster shape Tags Asserts Status Agent
service-mesh-linkerd-basic-mesh
Linkerd — Basic Mesh (Sidecar Injection)
 kind
+ linkerd-crds, linkerd-control-plane
 nightly 0/0 UNTESTED —
service-mesh-linkerd-mtls-rotation
Linkerd — mTLS Identity Rotation
 kind
+ linkerd-crds, linkerd-control-plane
 nightly 0/0 UNTESTED —
service-mesh-linkerd-multi-cluster-preview
Linkerd — Multi-Cluster Preview
 kind
+ linkerd-crds, linkerd-control-plane, linkerd-multicluster
 nightly 0/0 UNTESTED —
service-mesh-linkerd-service-profile
Linkerd — ServiceProfile (Per-Route Observability)
 kind
+ linkerd-crds, linkerd-control-plane
 nightly 0/0 UNTESTED —
UNTESTED 3 variants: 3 UNTESTED addon/manual-tls-secret
Scenario Cluster shape Tags Asserts Status Agent
certificates-manual-tls-secret-basic
manual-tls-secret basic
 kind nightly 0/0 UNTESTED —
certificates-manual-tls-secret-ecdsa
manual-tls-secret ECDSA key
 kind nightly 0/0 UNTESTED —
certificates-manual-tls-secret-multiple-sans
manual-tls-secret multiple SANs
 kind nightly 0/0 UNTESTED —
UNTESTED 3 variants: 3 UNTESTED addon/mounted-tls-certs
Scenario Cluster shape Tags Asserts Status Agent
certificates-mounted-tls-certs-csi-secret-store
mounted-tls-certs csi-secret-store
 kind
+ csi-secrets-store
 nightly 0/0 UNTESTED —
certificates-mounted-tls-certs-projected-volume
mounted-tls-certs projected-volume
 kind nightly 0/0 UNTESTED —
certificates-mounted-tls-certs-pvc-mount
mounted-tls-certs pvc-mount
 kind nightly 0/0 UNTESTED —
UNTESTED 4 variants: 4 UNTESTED addon/nginx-ingress
Scenario Cluster shape Tags Asserts Status Agent
ingress-controllers-nginx-ingress-basic
NGINX Ingress basic routing
 kind
+ ingress-nginx
 nightly 0/0 UNTESTED —
ingress-controllers-nginx-ingress-canary
NGINX Ingress canary traffic splitting
 kind
+ ingress-nginx
 nightly 0/0 UNTESTED —
ingress-controllers-nginx-ingress-default-backend
NGINX Ingress custom default backend
 kind
+ ingress-nginx
 nightly 0/0 UNTESTED —
ingress-controllers-nginx-ingress-snippet-annotations
NGINX Ingress snippet annotations
 kind
+ ingress-nginx
 nightly 0/0 UNTESTED —
UNTESTED 4 variants: 4 UNTESTED addon/opa-gatekeeper
Scenario Cluster shape Tags Asserts Status Agent
policy-opa-gatekeeper-image-allowlist
OPA Gatekeeper image allowlist enforcement
 kind
+ gatekeeper
 nightly 0/0 UNTESTED —
policy-opa-gatekeeper-required-labels
OPA Gatekeeper required labels enforcement
 kind
+ gatekeeper, ingress-nginx
 nightly 0/0 UNTESTED —
policy-opa-gatekeeper-resource-limits
OPA Gatekeeper resource limits enforcement
 kind
+ gatekeeper
 nightly 0/0 UNTESTED —
policy-opa-gatekeeper-sync-config
OPA Gatekeeper sync configuration
 kind
+ gatekeeper
 nightly 0/0 UNTESTED —
UNTESTED 4 variants: 4 UNTESTED addon/traefik
Scenario Cluster shape Tags Asserts Status Agent
ingress-controllers-traefik-basic
Traefik basic IngressRoute
 kind
+ traefik
 nightly 0/0 UNTESTED —
ingress-controllers-traefik-ingressroute-crd
Traefik IngressRoute CRD
 kind
+ traefik
 nightly 0/0 UNTESTED —
ingress-controllers-traefik-middleware-chain
Traefik middleware chain
 kind
+ traefik
 nightly 0/0 UNTESTED —
ingress-controllers-traefik-tls-passthrough
Traefik TLS passthrough
 kind
+ traefik
 nightly 0/0 UNTESTED —

Scenarios — details

certificates-cert-manager-jks-pkcs12 cert-manager JKS/PKCS12 keystore bundle UNTESTED
Description
Installs cert-manager with a self-signed ClusterIssuer, issues a Certificate, wraps tls.crt+tls.key into a PKCS12 bundle, and stores as a new Secret alongside the TLS material.
Cluster
kind
Preinstalled
cert-manager
Mechanisms
addon:cert-manager
Tags
nightly
Labels
customer=any profile=tls

⚠ no agent reported on this scenario — UNTESTED

certificates-cert-manager-lets-encrypt-staging cert-manager Let's Encrypt staging issuer UNTESTED
Description
Installs cert-manager with Let's Encrypt staging ACME issuer. Verifies ClusterIssuer Ready=True and uses self-signed fallback Certificate to confirm chart pods serve TLS.
Cluster
kind
Preinstalled
cert-manager
Mechanisms
addon:cert-manager
Tags
nightly
Labels
customer=any profile=tls

⚠ no agent reported on this scenario — UNTESTED

certificates-cert-manager-self-signed-ca cert-manager self-signed CA issuer UNTESTED
Description
Installs cert-manager, creates a self-signed ClusterIssuer, issues a Certificate for the product Service FQDN, and verifies HTTPS serving with --cacert.
Cluster
kind
Preinstalled
cert-manager
Mechanisms
addon:cert-manager
Tags
nightly
Labels
customer=any profile=tls

⚠ no agent reported on this scenario — UNTESTED

certificates-cert-manager-wildcard cert-manager wildcard certificate UNTESTED
Description
Installs cert-manager with a self-signed ClusterIssuer, issues a wildcard Certificate with SAN DNS:*.test.local + test.local, and verifies both SANs are present.
Cluster
kind
Preinstalled
cert-manager
Mechanisms
addon:cert-manager
Tags
nightly
Labels
customer=any profile=tls

⚠ no agent reported on this scenario — UNTESTED

certificates-manual-tls-secret-basic manual-tls-secret basic UNTESTED
Description
Delivers a pre-provisioned TLS Secret (RSA 2048) via raw_manifest preinstall and verifies the chart serves HTTPS with it. No cert-manager dependency.
Cluster
kind
Mechanisms
addon:manual-tls-secret
Tags
nightly
Labels
customer=any profile=tls

⚠ no agent reported on this scenario — UNTESTED

certificates-manual-tls-secret-ecdsa manual-tls-secret ECDSA key UNTESTED
Description
Delivers a pre-provisioned TLS Secret with ECDSA P-256 key via raw_manifest. Verifies cert has id-ecPublicKey algorithm and pods serve HTTPS with the ECDSA key.
Cluster
kind
Mechanisms
addon:manual-tls-secret
Tags
nightly
Labels
customer=any profile=tls

⚠ no agent reported on this scenario — UNTESTED

certificates-manual-tls-secret-multiple-sans manual-tls-secret multiple SANs UNTESTED
Description
Delivers a pre-provisioned TLS Secret with 3 DNS SANs (sample.sample.svc, api.sample.sample.svc, admin.sample.sample.svc) via raw_manifest and verifies the cert has >=2 SAN entries.
Cluster
kind
Mechanisms
addon:manual-tls-secret
Tags
nightly
Labels
customer=any profile=tls

⚠ no agent reported on this scenario — UNTESTED

certificates-mounted-tls-certs-csi-secret-store mounted-tls-certs csi-secret-store UNTESTED
Description
Installs the secrets-store-csi-driver helm chart and a stub SecretProviderClass, then installs the chart with a TLS secret volume. Verifies CSI driver presence, SecretProviderClass resource, and that the product pod serves HTTPS. Full CSI volume mount verification requires a real CSI provider plugin (e.g. AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, or HashiCorp Vault) which is not available on kind; the scenario validates CSI infrastructure deployment and documents the mount verification as a SKIP on kind.
Cluster
kind
Preinstalled
csi-secrets-store
Mechanisms
addon:mounted-tls-certs
Tags
nightly
Labels
customer=any profile=tls

⚠ no agent reported on this scenario — UNTESTED

certificates-mounted-tls-certs-projected-volume mounted-tls-certs projected-volume UNTESTED
Description
Creates a TLS Secret, then installs the chart using a projected volume that projects the Secret into the pod. Verifies projected volume source and HTTPS serving.
Cluster
kind
Mechanisms
addon:mounted-tls-certs
Tags
nightly
Labels
customer=any profile=tls

⚠ no agent reported on this scenario — UNTESTED

certificates-mounted-tls-certs-pvc-mount mounted-tls-certs pvc-mount UNTESTED
Description
Creates a PVC, populates it with TLS certs via a Job, then installs the chart with a persistentVolumeClaim-backed TLS volume. Verifies the pod mount and HTTPS serving.
Cluster
kind
Mechanisms
addon:mounted-tls-certs
Tags
nightly
Labels
customer=any profile=tls

⚠ no agent reported on this scenario — UNTESTED

customer-a-istio Customer A — Istio mesh + cert-manager UNTESTED
Description
Customer A's profile: istio sidecar injection, istio-ingress, cert-manager.
Cluster
kind
Preinstalled
cert-manager, istio-base, istiod
Mechanisms
addon:istioaddon:cert-managermesh:istiocustomer:A
Tags
nightlycustomer-replica
Labels
customer=A mesh=istio ingress=istio-gw

⚠ no agent reported on this scenario — UNTESTED

customer-b-gatekeeper Customer B — OPA Gatekeeper admission policies UNTESTED
Description
Customer B runs Gatekeeper with strict admission policies. Chart must satisfy required-labels + no-privileged constraints.
Cluster
kind
Preinstalled
gatekeeper
Mechanisms
addon:gatekeepercustomer:B
Tags
nightlycustomer-replica
Labels
customer=B policy=gatekeeper

⚠ no agent reported on this scenario — UNTESTED

envoy-gateway Envoy Gateway (Gateway API) UNTESTED
Description
Installs Envoy Gateway controller via OCI helm chart (CRDs are bundled in the chart's crds/ directory and installed automatically by Helm before templates). Verifies chart coexists with a running gateway controller.
Cluster
kind
Preinstalled
envoy-gateway
Mechanisms
addon:envoy-gatewaygateway-api:envoy
Tags
nightly
Labels
customer=none profile=gateway-api

⚠ no agent reported on this scenario — UNTESTED

gateway-api-contour-gateway-api-basic Contour Gateway API Basic UNTESTED
Description
Installs Gateway API CRDs and Contour Gateway Provisioner, creates GatewayClass contour + Gateway + HTTPRoute, and verifies HTTP routing through the auto-provisioned Envoy proxy.
Cluster
kind
Mechanisms
addon:contourgateway-api:contour
Tags
nightly
Labels
customer=any profile=gateway-api

⚠ no agent reported on this scenario — UNTESTED

gateway-api-contour-gateway-api-response-header-modifier Contour Gateway API Response Header Modifier UNTESTED
Description
Installs Gateway API CRDs + Contour Gateway Provisioner, creates GatewayClass contour + Gateway + HTTPRoute with ResponseHeaderModifier filter, verifies X-Powered-By header.
Cluster
kind
Mechanisms
addon:contourgateway-api:contour
Tags
nightly
Labels
customer=any profile=gateway-api

⚠ no agent reported on this scenario — UNTESTED

gateway-api-contour-gateway-api-route-precedence Contour Gateway API Route Precedence UNTESTED
Description
Installs Gateway API CRDs + Contour Gateway Provisioner, creates GatewayClass contour + Gateway + two HTTPRoutes with overlapping prefixes, verifies more specific route wins.
Cluster
kind
Mechanisms
addon:contourgateway-api:contour
Tags
nightly
Labels
customer=any profile=gateway-api

⚠ no agent reported on this scenario — UNTESTED

gateway-api-envoy-gateway-cert-manager-tls Envoy Gateway + cert-manager TLS UNTESTED
Description
Installs cert-manager and envoy-gateway, issues a TLS certificate, creates Gateway with HTTPS listener using cert-manager Secret, and verifies HTTPS serving with expected cert.
Cluster
kind
Preinstalled
envoy-gateway, cert-manager
Mechanisms
addon:envoy-gatewayaddon:cert-managergateway-api:envoy
Tags
nightly
Labels
customer=any profile=gateway-api-tls

⚠ no agent reported on this scenario — UNTESTED

gateway-api-envoy-gateway-grpcroute Envoy Gateway GRPCRoute UNTESTED
Description
Installs Gateway API CRDs and envoy-gateway controller, deploys a gRPC backend, creates GRPCRoute, and verifies gRPC reflection through the Envoy proxy.
Cluster
kind
Preinstalled
envoy-gateway
Mechanisms
addon:envoy-gatewaygateway-api:envoy
Tags
nightly
Labels
customer=any profile=gateway-api

⚠ no agent reported on this scenario — UNTESTED

gateway-api-envoy-gateway-httproute Envoy Gateway HTTPRoute UNTESTED
Description
Installs Gateway API CRDs and envoy-gateway controller, creates GatewayClass+Gateway+HTTPRoute, and verifies HTTP routing through the Envoy proxy.
Cluster
kind
Preinstalled
envoy-gateway
Mechanisms
addon:envoy-gatewaygateway-api:envoy
Tags
nightly
Labels
customer=any profile=gateway-api

⚠ no agent reported on this scenario — UNTESTED

gateway-api-envoy-gateway-security-policy-attach Envoy Gateway SecurityPolicy (CORS) UNTESTED
Description
Installs Gateway API CRDs and envoy-gateway controller, creates HTTPRoute with SecurityPolicy (CORS) attaching to the route, and verifies CORS header on preflight.
Cluster
kind
Preinstalled
envoy-gateway
Mechanisms
addon:envoy-gatewaygateway-api:envoy
Tags
nightly
Labels
customer=any profile=gateway-api

⚠ no agent reported on this scenario — UNTESTED

gateway-api-istio-gateway-api-backend-tls-policy Istio Gateway API BackendTLSPolicy UNTESTED
Description
Installs istio/base + istio/istiod and Gateway API CRDs, generates self-signed TLS certs at runtime, creates BackendTLSPolicy targeting the Service, and verifies Policy acceptance and gateway routing.
Cluster
kind
Preinstalled
istio-base, istiod
Mechanisms
addon:istiogateway-api:istio
Tags
nightly
Labels
customer=any profile=gateway-api-backendtls

⚠ no agent reported on this scenario — UNTESTED

gateway-api-istio-gateway-api-basic Istio Gateway API Basic UNTESTED
Description
Installs istio/base + istio/istiod and Gateway API CRDs, creates GatewayClass istio + Gateway + HTTPRoute, and verifies HTTP routing through auto-provisioned Istio data-plane.
Cluster
kind
Preinstalled
istio-base, istiod
Mechanisms
addon:istiogateway-api:istio
Tags
nightly
Labels
customer=any profile=gateway-api

⚠ no agent reported on this scenario — UNTESTED

gateway-api-istio-gateway-api-multi-listener Istio Gateway API Multi-Listener UNTESTED
Description
Installs istio/base + istio/istiod and Gateway API CRDs, creates Gateway with HTTP:80 + HTTPS:443 listeners, and verifies both protocols with TLS certificate.
Cluster
kind
Preinstalled
istio-base, istiod
Mechanisms
addon:istiogateway-api:istio
Tags
nightly
Labels
customer=any profile=gateway-api-multilistener

⚠ no agent reported on this scenario — UNTESTED

ingress-controllers-contour-basic-httpproxy Contour basic HTTPProxy UNTESTED
Description
Installs Contour, creates an HTTPProxy for the product Service, and verifies HTTP routing through the envoy pod IP with Host header matching and HTTPProxy status valid.
Cluster
kind
Preinstalled
contour
Mechanisms
addon:contour
Tags
nightly
Labels
customer=any profile=ingress

⚠ no agent reported on this scenario — UNTESTED

ingress-controllers-contour-rate-limit Contour rate limit UNTESTED
Description
Installs Contour, creates an HTTPProxy with local rateLimitPolicy (5 req/min), and verifies that exceeding the limit produces 429 responses while requests within the limit succeed.
Cluster
kind
Preinstalled
contour
Mechanisms
addon:contour
Tags
nightly
Labels
customer=any profile=ingress

⚠ no agent reported on this scenario — UNTESTED

ingress-controllers-contour-tls-delegation Contour TLS delegation UNTESTED
Description
Installs Contour, deploys TLS Secret in tls-secrets NS, grants cross-namespace access via TLSCertificateDelegation, creates HTTPProxy with delegated Secret, verifies HTTPS 200.
Cluster
kind
Preinstalled
contour
Mechanisms
addon:contour
Tags
nightly
Labels
customer=any profile=ingress

⚠ no agent reported on this scenario — UNTESTED

ingress-controllers-nginx-ingress-basic NGINX Ingress basic routing UNTESTED
Description
Installs NGINX Ingress controller, creates an Ingress with ingressClassName: nginx, and verifies Host-header routing returns HTTP 200.
Cluster
kind
Preinstalled
ingress-nginx
Mechanisms
addon:nginx-ingress
Tags
nightly
Labels
customer=any profile=ingress

⚠ no agent reported on this scenario — UNTESTED

ingress-controllers-nginx-ingress-canary NGINX Ingress canary traffic splitting UNTESTED
Description
Installs NGINX Ingress controller with stable+canary Ingresses (canary-weight=20), deploys a canary backend with distinctive response, verifies ~20% of 100 probes hit canary.
Cluster
kind
Preinstalled
ingress-nginx
Mechanisms
addon:nginx-ingress
Tags
nightly
Labels
customer=any profile=ingress

⚠ no agent reported on this scenario — UNTESTED

ingress-controllers-nginx-ingress-default-backend NGINX Ingress custom default backend UNTESTED
Description
Installs NGINX Ingress with custom default backend Deployment+Service, verifies requests without matching Host return the custom backend's distinctive body instead of stock 404.
Cluster
kind
Preinstalled
ingress-nginx
Mechanisms
addon:nginx-ingress
Tags
nightly
Labels
customer=any profile=ingress

⚠ no agent reported on this scenario — UNTESTED

ingress-controllers-nginx-ingress-snippet-annotations NGINX Ingress snippet annotations UNTESTED
Description
Installs NGINX Ingress with allowSnippetAnnotations=true, creates an Ingress with configuration-snippet annotation injecting add_header X-Test, verifies the header appears.
Cluster
kind
Preinstalled
ingress-nginx
Mechanisms
addon:nginx-ingress
Tags
nightly
Labels
customer=any profile=ingress

⚠ no agent reported on this scenario — UNTESTED

ingress-controllers-nginx-ingress-tls-cert-manager NGINX Ingress TLS with cert-manager UNTESTED
Description
Installs cert-manager + NGINX Ingress, creates self-signed ClusterIssuer+Certificate, verifies HTTPS routing through nginx with TLS terminated by cert-manager-issued cert chain.
Cluster
kind
Preinstalled
cert-manager, ingress-nginx
Mechanisms
addon:cert-manageraddon:nginx-ingress
Tags
nightly
Labels
customer=any profile=tls

⚠ no agent reported on this scenario — UNTESTED

ingress-controllers-traefik-basic Traefik basic IngressRoute UNTESTED
Description
Installs Traefik, creates an IngressRoute for the product Service, and verifies HTTP routing through the Traefik pod IP with Host header matching.
Cluster
kind
Preinstalled
traefik
Mechanisms
addon:traefik
Tags
nightly
Labels
customer=any profile=ingress

⚠ no agent reported on this scenario — UNTESTED

ingress-controllers-traefik-ingressroute-crd Traefik IngressRoute CRD UNTESTED
Description
Installs Traefik, uses IngressRoute CRD exclusively for routing (no classic Ingress), and verifies HTTP traffic reaches the backend.
Cluster
kind
Preinstalled
traefik
Mechanisms
addon:traefik
Tags
nightly
Labels
customer=any profile=ingress

⚠ no agent reported on this scenario — UNTESTED

ingress-controllers-traefik-middleware-chain Traefik middleware chain UNTESTED
Description
Installs Traefik, creates a Middleware CR that injects custom headers, references it from an IngressRoute, and verifies the middleware effect is observable.
Cluster
kind
Preinstalled
traefik
Mechanisms
addon:traefik
Tags
nightly
Labels
customer=any profile=ingress

⚠ no agent reported on this scenario — UNTESTED

ingress-controllers-traefik-tls-passthrough Traefik TLS passthrough UNTESTED
Description
Installs Traefik, configures IngressRouteTCP with tls.passthrough=true, and verifies the backend's TLS certificate is served untouched through the proxy.
Cluster
kind
Preinstalled
traefik
Mechanisms
addon:traefik
Tags
nightly
Labels
customer=any profile=tls

⚠ no agent reported on this scenario — UNTESTED

minimal Vanilla cluster — no preinstalled addons UNTESTED
Description
Baseline: chart installs and pods come up on a stock kind cluster.
Cluster
kind
Mechanisms
addon:none
Tags
pr-subsetnightly
Labels
customer=none profile=baseline

⚠ no agent reported on this scenario — UNTESTED

policy-kyverno-generate Kyverno generate: ConfigMap in labeled namespaces UNTESTED
Description
Installs Kyverno, creates a ClusterPolicy that generates a ConfigMap in any namespace labeled kyverno.io/generate=true. Verifies that creating a fresh namespace with the trigger label causes Kyverno to generate the ConfigMap within 10s. Webhook failure mode: Fail.
Cluster
kind
Preinstalled
kyverno
Mechanisms
addon:kyverno
Tags
nightly
Labels
customer=any profile=policy

⚠ no agent reported on this scenario — UNTESTED

policy-kyverno-image-verify Kyverno image-verify: only approved registries UNTESTED
Description
Installs Kyverno, creates a ClusterPolicy that only allows images from public.ecr.aws/* or nginx* registries. Verifies a Pod referencing docker.io/library/redis:7-alpine is denied (stderr names rule), while a Pod with an approved image is accepted. Webhook failure mode: Fail.
Cluster
kind
Preinstalled
kyverno
Mechanisms
addon:kyverno
Tags
nightly
Labels
customer=any profile=policy

⚠ no agent reported on this scenario — UNTESTED

policy-kyverno-mutate Kyverno mutate: auto-add annotation to Pods UNTESTED
Description
Installs Kyverno, creates a ClusterPolicy that adds the annotation kyverno.io/managed-by: chart-test-swarm to Pods. Verifies a Pod manifest lacking the annotation gets it auto-added after the mutating webhook fires. Webhook failure mode: Fail.
Cluster
kind
Preinstalled
kyverno
Mechanisms
addon:kyverno
Tags
nightly
Labels
customer=any profile=policy

⚠ no agent reported on this scenario — UNTESTED

policy-kyverno-validate Kyverno validate: require labels on Deployments UNTESTED
Description
Installs Kyverno, creates a ClusterPolicy that requires app.kubernetes.io/name label on Deployments. Verifies non-compliant Deployment denied (stderr names validate.kyverno.svc-fail and policy name), compliant Deployment accepted. Webhook failure mode: Fail.
Cluster
kind
Preinstalled
kyverno
Mechanisms
addon:kyverno
Tags
nightly
Labels
customer=any profile=policy

⚠ no agent reported on this scenario — UNTESTED

policy-opa-gatekeeper-image-allowlist OPA Gatekeeper image allowlist enforcement UNTESTED
Description
Installs OPA Gatekeeper, creates k8sallowedrepos ConstraintTemplate + Constraint allowing only nginx + public.ecr.aws images. Verifies non-allowlisted image denied, allowlisted image accepted.
Cluster
kind
Preinstalled
gatekeeper
Mechanisms
addon:opa-gatekeeper
Tags
nightly
Labels
customer=any profile=policy

⚠ no agent reported on this scenario — UNTESTED

policy-opa-gatekeeper-required-labels OPA Gatekeeper required labels enforcement UNTESTED
Description
Installs OPA Gatekeeper + NGINX Ingress, creates k8srequiredlabels ConstraintTemplate + Constraint targeting Deployments and Ingress. Verifies non-compliant resources denied, compliant accepted. Cross-feature compose with M4 nginx-ingress.
Cluster
kind
Preinstalled
gatekeeper, ingress-nginx
Mechanisms
addon:opa-gatekeeperaddon:nginx-ingress
Tags
nightly
Labels
customer=any profile=policy

⚠ no agent reported on this scenario — UNTESTED

policy-opa-gatekeeper-resource-limits OPA Gatekeeper resource limits enforcement UNTESTED
Description
Installs OPA Gatekeeper, creates k8scontainerlimits ConstraintTemplate + Constraint requiring CPU and memory limits on all containers. Verifies Deployment without limits denied, compliant Deployment accepted.
Cluster
kind
Preinstalled
gatekeeper
Mechanisms
addon:opa-gatekeeper
Tags
nightly
Labels
customer=any profile=policy

⚠ no agent reported on this scenario — UNTESTED

policy-opa-gatekeeper-sync-config OPA Gatekeeper sync configuration UNTESTED
Description
Installs OPA Gatekeeper, applies Gatekeeper Config with sync.syncOnly listing Namespace, Pod, and Ingress kinds for OPA cache sync. Verifies Config exists with non-empty syncOnly, controller Ready.
Cluster
kind
Preinstalled
gatekeeper
Mechanisms
addon:opa-gatekeeper
Tags
nightly
Labels
customer=any profile=policy

⚠ no agent reported on this scenario — UNTESTED

service-mesh-istio-ingress-gateway-basic Istio Ingress Gateway — Basic UNTESTED
Description
Installs istio/base + istio/istiod + istio/gateway, deploys the product chart with ingress disabled, creates an Istio Gateway + VirtualService to route external traffic through the ingressgateway pod, and verifies HTTP 200 via the gateway with a Host header.
Cluster
kind
Preinstalled
istio-base, istiod, istio-ingressgateway
Mechanisms
addon:istiomesh:istio-ingress-gateway
Tags
nightly
Labels
customer=any profile=mesh

⚠ no agent reported on this scenario — UNTESTED

service-mesh-istio-ingress-gateway-jwt Istio Ingress Gateway — JWT Authentication UNTESTED
Description
Installs istio/base + istio/istiod + istio/gateway, deploys the product chart, creates an Istio Gateway + VirtualService, applies a RequestAuthentication + AuthorizationPolicy requiring a valid JWT, and verifies: (a) requests without a Bearer token are rejected with 401/403, (b) requests with a valid JWT signed by the test issuer key from fixtures/service-mesh/jwt/ return HTTP 200.
Cluster
kind
Preinstalled
istio-base, istiod, istio-ingressgateway
Mechanisms
addon:istiomesh:istio-ingress-gateway
Tags
nightly
Labels
customer=any profile=mesh

⚠ no agent reported on this scenario — UNTESTED

service-mesh-istio-ingress-gateway-multi-host Istio Ingress Gateway — Multi-Host UNTESTED
Description
Installs istio/base + istio/istiod + istio/gateway, deploys the product chart with scope.enabled=true, creates an Istio Gateway with two server blocks for different hosts, and a VirtualService that routes each host to a different backend (skywatcher vs scope). Verifies both hosts return HTTP 200 through the ingressgateway.
Cluster
kind
Preinstalled
istio-base, istiod, istio-ingressgateway
Mechanisms
addon:istiomesh:istio-ingress-gateway
Tags
nightly
Labels
customer=any profile=mesh

⚠ no agent reported on this scenario — UNTESTED

service-mesh-istio-ingress-gateway-request-authentication Istio Ingress Gateway — RequestAuthentication (No Deny) UNTESTED
Description
Installs istio/base + istio/istiod + istio/gateway, deploys the product chart, creates an Istio Gateway + VirtualService, applies a RequestAuthentication that validates JWTs from the test issuer but does NOT require them (no AuthorizationPolicy). Verifies: (a) requests without a token still pass through (HTTP 200), (b) requests with a valid JWT also return 200, and (c) requests with an invalid JWT (wrong issuer) are rejected with 401 by RequestAuthentication validation alone.
Cluster
kind
Preinstalled
istio-base, istiod, istio-ingressgateway
Mechanisms
addon:istiomesh:istio-ingress-gateway
Tags
nightly
Labels
customer=any profile=mesh

⚠ no agent reported on this scenario — UNTESTED

service-mesh-istio-service-mesh-cert-manager-tls Istio Service Mesh + cert-manager TLS Gateway UNTESTED
Description
Cross-feature compose: installs cert-manager + istio (base + istiod + gateway), creates a cert-manager self-signed ClusterIssuer and Certificate that issues a TLS Secret, then creates an Istio Gateway with a TLS listener referencing that Secret via credentialName. Verifies: istioctl analyze clean, HTTPS through gateway returns 200 with the cert-manager-issued certificate.
Cluster
kind
Preinstalled
cert-manager, istio-base, istiod, istio-ingressgateway
Mechanisms
addon:istioaddon:cert-managermesh:istio-service-mesh
Tags
nightly
Labels
customer=any profile=mesh-tls

⚠ no agent reported on this scenario — UNTESTED

service-mesh-istio-service-mesh-peer-authentication Istio Service Mesh — PeerAuthentication lifecycle UNTESTED
Description
Installs istio/base + istio/istiod, deploys the product chart with mesh.inject=true, and exercises the PeerAuthentication lifecycle: PERMISSIVE mode allows both mesh and non-mesh traffic; switching to STRICT mode blocks non-mesh traffic while mesh traffic continues via auto-upgraded mTLS.
Cluster
kind
Preinstalled
istio-base, istiod
Mechanisms
addon:istiomesh:istio-service-mesh
Tags
nightly
Labels
customer=any profile=mesh

⚠ no agent reported on this scenario — UNTESTED

service-mesh-istio-service-mesh-sidecar-injection Istio Service Mesh — Sidecar Injection UNTESTED
Description
Installs istio/base + istio/istiod, enables mesh injection on the product namespace, deploys the product chart with mesh.inject=true and scope.enabled=true, and verifies every product pod has exactly 2 containers including istio-proxy and in-mesh HTTP reaches the product Service with 200.
Cluster
kind
Preinstalled
istio-base, istiod
Mechanisms
addon:istiomesh:istio-service-mesh
Tags
nightly
Labels
customer=any profile=mesh

⚠ no agent reported on this scenario — UNTESTED

service-mesh-istio-service-mesh-strict-mtls Istio Service Mesh — strict mTLS UNTESTED
Description
Installs istio/base + istio/istiod, enables mesh injection, deploys the product chart with scope.enabled=true, creates a PeerAuthentication with mode=STRICT in the product namespace, and verifies: (a) plain HTTP from a non-mesh pod is rejected, (b) in-mesh probe pod still reaches the product Service with 200 via auto-upgraded mTLS.
Cluster
kind
Preinstalled
istio-base, istiod
Mechanisms
addon:istiomesh:istio-service-mesh
Tags
nightly
Labels
customer=any profile=mesh

⚠ no agent reported on this scenario — UNTESTED

service-mesh-istio-service-mesh-telemetry-v2 Istio Service Mesh — Telemetry v2 UNTESTED
Description
Installs istio/base + istio/istiod, deploys the product chart with mesh.inject=true, applies a Telemetry resource in the product namespace to configure Envoy access logging and metrics, and verifies proxy stats are accessible and telemetry configuration is active.
Cluster
kind
Preinstalled
istio-base, istiod
Mechanisms
addon:istiomesh:istio-service-mesh
Tags
nightly
Labels
customer=any profile=mesh

⚠ no agent reported on this scenario — UNTESTED

service-mesh-linkerd-basic-mesh Linkerd — Basic Mesh (Sidecar Injection) UNTESTED
Description
Installs linkerd-crds + linkerd-control-plane via Helm, annotates the product namespace with linkerd.io/inject=enabled, deploys the product chart with scope.enabled=true, and verifies every product pod has a linkerd-proxy sidecar alongside the app container (2-container pods), with linkerd check --proxy returning healthy.
Cluster
kind
Preinstalled
linkerd-crds, linkerd-control-plane
Mechanisms
addon:linkerdmesh:linkerd
Tags
nightly
Labels
customer=any profile=mesh

⚠ no agent reported on this scenario — UNTESTED

service-mesh-linkerd-mtls-rotation Linkerd — mTLS Identity Rotation UNTESTED
Description
Installs linkerd-crds + linkerd-control-plane via Helm, annotates the product namespace for injection, deploys the product chart, and verifies that mTLS identities are issued and valid by running linkerd check --proxy and inspecting the identity issuer certificate. Documents the mTLS rotation window and trust-anchor expiry.
Cluster
kind
Preinstalled
linkerd-crds, linkerd-control-plane
Mechanisms
addon:linkerdmesh:linkerd
Tags
nightly
Labels
customer=any profile=mesh

⚠ no agent reported on this scenario — UNTESTED

service-mesh-linkerd-multi-cluster-preview Linkerd — Multi-Cluster Preview UNTESTED
Description
Installs linkerd-crds + linkerd-control-plane + linkerd-multicluster extension via Helm, verifies the multicluster Link and ServiceMirror CRDs are established, and authors a preview Link resource targeting a logical target cluster. No real cross-cluster traffic — this variant validates that the multicluster extension installs cleanly and that the CRD scaffolding is functional.
Cluster
kind
Preinstalled
linkerd-crds, linkerd-control-plane, linkerd-multicluster
Mechanisms
addon:linkerdmesh:linkerd-multicluster
Tags
nightly
Labels
customer=any profile=mesh

⚠ no agent reported on this scenario — UNTESTED

service-mesh-linkerd-service-profile Linkerd — ServiceProfile (Per-Route Observability) UNTESTED
Description
Installs linkerd-crds + linkerd-control-plane via Helm, annotates the product namespace for injection, deploys the product chart, creates a ServiceProfile CRD for the sample Service defining routes with timeout and retry policies, and verifies the ServiceProfile is recognized.
Cluster
kind
Preinstalled
linkerd-crds, linkerd-control-plane
Mechanisms
addon:linkerdmesh:linkerd
Tags
nightly
Labels
customer=any profile=mesh

⚠ no agent reported on this scenario — UNTESTED

subchart-postgres-internal Internal postgres subchart enabled UNTESTED
Description
Product chart bundles postgres via subchart; verify both come up together.
Cluster
kind
Mechanisms
subchart:postgres-internal
Tags
pr-subsetnightly
Labels
profile=full-stack

⚠ no agent reported on this scenario — UNTESTED

with-cert-manager Customer ships cert-manager preinstalled UNTESTED
Description
Validates chart coexists with cert-manager and its CRDs.
Cluster
kind
Preinstalled
cert-manager
Mechanisms
addon:cert-manager
Tags
pr-subsetnightly
Labels
customer=any profile=tls

⚠ no agent reported on this scenario — UNTESTED