---
id: scheme-https-only
name: "Capability: HTTPS-only scheme enforcement (ON)"
description: >-
  Renders the product chart with TLS enabled (tls.enabled=true) and scheme=https-only, and asserts
  no plain-HTTP Service port, container port, or probe is present. A TLS secret fixture is
  preinstalled so the chart can deploy with tls.enabled=true. Ingress is disabled since the scheme
  is https-only (service handles TLS directly).
labels: {customer: enterprise, profile: compliance}
cluster:
  provider: kind
  k8s_version: v1.36.1
  preinstall:
    - kind: raw_manifest
      path: chart-test/fixtures/certificates/manual-tls/manual-tls-basic-secret.yaml
      namespace: sample
  helm_timeout: 10m
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    tls.enabled: true
    tls.secretName: manual-tls-basic
    scheme: https-only
asserts:
  - type: scheme-enforced
    namespace: sample
    source: rendered
    scheme: https-only
tags: [capability, compliance, curated-live]
category: capability
capability: protocol-scheme
tier: capability
mechanisms: ["capability:scheme"]