chart-test-swarm — run-bats-f17-3-orphan-36316

---
id: labels-on
name: "Capability: extra labels stamped on every object (ON)"
description: >-
  Renders the product chart with a global extra-label knob set (extraLabels.team=platform, extraLabels.cost-center=42) and asserts every rendered object (all kinds, not just pod templates) carries the configured labels at .metadata.labels. The sample chart does NOT expose an extraLabels/commonLabels knob — this scenario is EXPECTED to FAIL (honest red gap) documenting that the chart lacks global label propagation.
labels: {customer: enterprise, profile: compliance}
cluster:
  provider: kind
  k8s_version: v1.30.0
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    ingress.enabled: true
    extraLabels.team: platform
    extraLabels.cost-center: "42"
asserts:
  - type: labels-present
    namespace: sample
    source: rendered
    labels:
      team: platform
      cost-center: "42"
tags: [capability, compliance, curated-live]
category: capability
capability: label-all-objects
tier: capability
mechanisms: ["capability:labels"]

helm_values:
  {replicaCount: 1, image: {repository: nginx, tag: "1.27-alpine"}, service: {type: ClusterIP, port: 80}, tls: {enabled: false, secretName: "", servicePort: 443,
      # -- Filesystem path where TLS cert+key are mounted. Defaults to /etc/tls.
      mountPath: "",
      # -- Volume type for the TLS material. Supported: secret (default), persistentVolumeClaim, projected, csi.
      volumeType: "secret",
      # -- PVC claim name (required when volumeType is persistentVolumeClaim).
      pvcClaimName: "",
      # -- SecretProviderClass name (required when volumeType is csi).
      secretProviderClass: "",
      # -- Whether to run the wait-for-tls initContainer that polls for cert files. Disable for CSI volumes that are populated asynchronously.
      waitForCerts: true},
    # -- Scope component (API server). Creates a separate Deployment + Service on port 8080.
    scope: {enabled: false, replicaCount: 1, image: {repository: nginx, tag: "1.27-alpine"}, service: {port: 8080}},
    # -- Darkroom component (async processor). Creates a separate Deployment with optional PVC mount.
    darkroom: {enabled: false, replicaCount: 1, image: {repository: nginx, tag: "1.27-alpine"}, pvc: {enabled: false, claimName: "", mountPath: /data}},
    # -- Ingress resource for skywatcher Service.
    ingress: {enabled: false, className: "nginx", host: "", path: /, pathType: Prefix},
    # -- HTTPRoute resource for Gateway API integration.
    gatewayRoute: {enabled: false, parentRef: {name: envoy, namespace: "", sectionName: ""}, hostname: ""},
    # -- Service mesh integration.
    mesh: {inject: false},
    # -- Policy compliance labels applied to pod templates.
    policy: {complianceLabels: {}}, ingress.enabled: true, extraLabels.team: platform, extraLabels.cost-center: "42"}
raw_manifest_refs:
  []