---
id: scheme-allow-http
name: "Capability: HTTP baseline scheme (OFF)"
description: >-
  Renders the product chart with default values (no TLS override) and asserts the plain-HTTP port 80 IS present on the Service, confirming the off-case baseline that the HTTPS-only knob must be able to suppress. This scenario is EXPECTED to PASS — the default render exposes port 80 (name: http) on the skywatcher Service.
labels: {customer: enterprise, profile: compliance}
cluster:
  provider: kind
  k8s_version: v1.30.0
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    ingress.enabled: true
    ingress.host: sample.local
asserts:
  - type: scheme-enforced
    namespace: sample
    source: rendered
    scheme: allow-http
tags: [capability, compliance]
category: capability
capability: protocol-scheme
tier: capability
mechanisms: ["capability:scheme"]