Scenario pass rate and support status across all catalog scenarios. Green = passing; red = gap to fix or build next.
Counts exclude authored-only (cloud) scenarios.
One row per scenario. Cells link to the exact scenario YAML and applied overrides. Authored-only entries are marked ☁ AUTHORED and excluded from run counts.
| Capability / Scenario | Tier | Status | Scenario YAML | Applied Overrides |
|---|---|---|---|---|
scheduling-affinity-on
Capability: affinity settable on ALL workloads (ON) capability/affinity |
capability
|
PASS | scenario.yaml | not yet run |
annotations-off
Capability: no custom annotation leaks when unset (OFF) capability/annotate-all-objects |
capability
|
PASS | scenario.yaml | not yet run |
annotations-on
Capability: custom annotations stamped on every object (ON) capability/annotate-all-objects |
capability
|
PASS | scenario.yaml | not yet run |
minimal
Vanilla cluster — no preinstalled addons capability/baseline-deploy |
capability
|
UNTESTED | scenario.yaml | applied-overrides.yaml |
capability-generated-scenario
Capability: generated-scenario capability/generated-scenario |
capability
|
PASS | scenario.yaml | not yet run |
imagepullsecrets-off
Capability: no imagePullSecrets when unset (OFF) capability/imagepullsecrets |
capability
|
PASS | scenario.yaml | not yet run |
imagepullsecrets-on
Capability: imagePullSecrets propagate to every pod spec + ServiceAccount (ON) capability/imagepullsecrets |
capability
|
PASS | scenario.yaml | not yet run |
labels-off
Capability: no extra-label keys leak when unset (OFF) capability/label-all-objects |
capability
|
PASS | scenario.yaml | not yet run |
labels-on
Capability: extra labels stamped on every object (ON) capability/label-all-objects |
capability
|
PASS | scenario.yaml | not yet run |
network-policy-off
Capability: no NetworkPolicy when disabled (OFF) capability/network-policy |
capability
|
PASS | scenario.yaml | not yet run |
network-policy-on
Capability: NetworkPolicy present when enabled (ON) capability/network-policy |
capability
|
PASS | scenario.yaml | not yet run |
scheduling-nodeselector-on
Capability: nodeSelector settable on ALL workloads (ON) capability/node-selector |
capability
|
PASS | scenario.yaml | not yet run |
security-context-off
Capability: no securityContext when knobs unset (OFF) capability/pod-security |
capability
|
PASS | scenario.yaml | not yet run |
security-context-on
Capability: pod/container securityContext knobs set (ON) capability/pod-security |
capability
|
PASS | scenario.yaml | not yet run |
priority-class-off
Capability: no priorityClassName when unset (OFF) capability/priority-class-name |
capability
|
PASS | scenario.yaml | not yet run |
priority-class-on
Capability: priorityClassName settable on ALL workloads (ON) capability/priority-class-name |
capability
|
PASS | scenario.yaml | not yet run |
scheme-allow-http
Capability: HTTP baseline scheme (OFF) capability/protocol-scheme |
capability
|
PASS | scenario.yaml | not yet run |
scheme-https-only
Capability: HTTPS-only scheme enforcement (ON) capability/protocol-scheme |
capability
|
PASS | scenario.yaml | not yet run |
rbac-effective-boundary
RBAC effective: boundary check via kubectl auth can-i capability/rbac-effective |
live
|
PASS | scenario.yaml | not yet run |
rbac-off
Capability: no RBAC objects when disabled (OFF) capability/rbac-toggle |
capability
|
PASS | scenario.yaml | not yet run |
rbac-on
Capability: RBAC objects present when enabled (ON) capability/rbac-toggle |
capability
|
PASS | scenario.yaml | not yet run |
resources-off
Capability: no populated resources block when unset (OFF) capability/resource-limits |
capability
|
PASS | scenario.yaml | not yet run |
resources-on
Capability: resource requests/limits set on ALL workloads (ON) capability/resource-limits |
capability
|
PASS | scenario.yaml | not yet run |
scheduling-off
Capability: no scheduling fields when unset (OFF) capability/scheduling-off |
capability
|
PASS | scenario.yaml | not yet run |
scheduling-target-node
Scheduling: scheduled-on-target L3 behavioral assert capability/scheduling-target |
live
|
PASS | scenario.yaml | not yet run |
serviceaccount-annotations-off
Capability: ServiceAccount identity annotations absent when unset (OFF) capability/serviceaccount-identity |
capability
|
PASS | scenario.yaml | not yet run |
serviceaccount-annotations-on
Capability: ServiceAccount cloud-identity annotations settable (ON) capability/serviceaccount-identity |
capability
|
PASS | scenario.yaml | not yet run |
scheduling-tolerations-on
Capability: tolerations settable on ALL workloads (ON) capability/tolerations |
capability
|
PASS | scenario.yaml | not yet run |
scheduling-topology-spread-on
Capability: topologySpreadConstraints settable on ALL workloads (ON) capability/topology-spread-constraints |
capability
|
PASS | scenario.yaml | not yet run |
| Capability / Scenario | Tier | Status | Scenario YAML | Applied Overrides |
|---|---|---|---|---|
certificates-cert-manager-jks-pkcs12
cert-manager JKS/PKCS12 keystore bundle certificates/cert-manager |
live
|
PASS | scenario.yaml | not yet run |
certificates-cert-manager-lets-encrypt-staging
cert-manager Let's Encrypt staging issuer certificates/cert-manager |
live
|
PASS | scenario.yaml | not yet run |
certificates-cert-manager-self-signed-ca
cert-manager self-signed CA issuer certificates/cert-manager |
live
|
PASS | scenario.yaml | not yet run |
certificates-cert-manager-wildcard
cert-manager wildcard certificate certificates/cert-manager |
live
|
PASS | scenario.yaml | not yet run |
tls-cert-manager-self-signed
cert-manager self-signed Issuer -> CA Cert -> CA Issuer -> leaf Cert certificates/cert-manager |
live
|
PASS | scenario.yaml | not yet run |
with-cert-manager
Customer ships cert-manager preinstalled certificates/cert-manager |
live
|
PASS | scenario.yaml | not yet run |
certificates-manual-tls-secret-basic
manual-tls-secret basic certificates/manual-tls-secret |
live
|
PASS | scenario.yaml | not yet run |
certificates-manual-tls-secret-ecdsa
manual-tls-secret ECDSA key certificates/manual-tls-secret |
live
|
PASS | scenario.yaml | not yet run |
certificates-manual-tls-secret-multiple-sans
manual-tls-secret multiple SANs certificates/manual-tls-secret |
live
|
PASS | scenario.yaml | not yet run |
tls-manual-secret
Manual TLS Secret via raw_manifest certificates/manual-tls-secret |
live
|
PASS | scenario.yaml | not yet run |
certificates-mounted-tls-certs-csi-secret-store
mounted-tls-certs csi-secret-store certificates/mounted-tls-certs |
live
|
PASS | scenario.yaml | not yet run |
certificates-mounted-tls-certs-projected-volume
mounted-tls-certs projected-volume certificates/mounted-tls-certs |
live
|
PASS | scenario.yaml | not yet run |
certificates-mounted-tls-certs-pvc-mount
mounted-tls-certs pvc-mount certificates/mounted-tls-certs |
live
|
PASS | scenario.yaml | not yet run |
tls-mounted-projected
TLS via projected volume certificates/mounted-tls-certs |
live
|
PASS | scenario.yaml | not yet run |
tls-mounted-pvc
TLS via persistentVolumeClaim certificates/mounted-tls-certs |
live
|
PASS | scenario.yaml | not yet run |
| Capability / Scenario | Tier | Status | Scenario YAML | Applied Overrides |
|---|---|---|---|---|
cloud-native-aks-agic
AKS Application Gateway Ingress Controller (AGIC) cloud-native/aks-agic |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
cloud-native-aks-app-routing
AKS App Routing Addon cloud-native/aks-app-routing |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
cloud-native-aks-azure-policy
AKS Azure Policy cloud-native/aks-azure-policy |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
cloud-native-aks-workload-identity
AKS Workload Identity cloud-native/aks-workload-identity |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
cloud-native-eks-ack-s3
EKS ACK (AWS Controllers for Kubernetes) S3 cloud-native/aws-ack-s3 |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
cloud-native-eks-alb-ingress
EKS ALB Ingress Controller cloud-native/aws-load-balancer-controller |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
cloud-native-eks-fargate
EKS Fargate cloud-native/eks-fargate |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
cloud-native-eks-irsa
EKS IRSA (IAM Roles for Service Accounts) cloud-native/eks-irsa |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
cloud-native-gke-gateway-controller
GKE Gateway Controller cloud-native/gke-gateway-controller |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
cloud-native-gke-iap
GKE Identity-Aware Proxy cloud-native/gke-iap |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
cloud-native-gke-regional-networking
GKE Regional Cluster Networking cloud-native/gke-regional-networking |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
cloud-native-gke-workload-identity
GKE Workload Identity cloud-native/gke-workload-identity |
authored-only
☁ AUTHORED
|
scenario.yaml | not run |
| Capability / Scenario | Tier | Status | Scenario YAML | Applied Overrides |
|---|---|---|---|---|
cni-cilium-ebpf-kube-proxy-replacement
Cilium eBPF kube-proxy replacement cni/cilium |
live
|
PASS | scenario.yaml | not yet run |
cni-cilium-ingress
Cilium ingress controller — dedicated loadbalancerMode cni/cilium |
live
|
PASS | scenario.yaml | not yet run |
cni-cilium-network-policy
CiliumNetworkPolicy enforcement — default-deny + allow-by-label cni/cilium |
live
|
PASS | scenario.yaml | not yet run |
| Capability / Scenario | Tier | Status | Scenario YAML | Applied Overrides |
|---|---|---|---|---|
gateway-api-contour-gateway-api-basic
Contour Gateway API Basic gateway-api/contour |
live
|
PASS | scenario.yaml | not yet run |
gateway-api-contour-gateway-api-response-header-modifier
Contour Gateway API Response Header Modifier gateway-api/contour |
live
|
PASS | scenario.yaml | not yet run |
gateway-api-contour-gateway-api-route-precedence
Contour Gateway API Route Precedence gateway-api/contour |
live
|
PASS | scenario.yaml | not yet run |
envoy-gateway
Envoy Gateway (Gateway API) gateway-api/envoy-gateway |
live
|
PASS | scenario.yaml | not yet run |
gateway-api-envoy-gateway-cert-manager-tls
Envoy Gateway + cert-manager TLS gateway-api/envoy-gateway |
live
|
PASS | scenario.yaml | not yet run |
gateway-api-envoy-gateway-grpcroute
Envoy Gateway GRPCRoute gateway-api/envoy-gateway |
live
|
PASS | scenario.yaml | not yet run |
gateway-api-envoy-gateway-httproute
Envoy Gateway HTTPRoute gateway-api/envoy-gateway |
live
|
PASS | scenario.yaml | not yet run |
gateway-api-envoy-gateway-security-policy-attach
Envoy Gateway SecurityPolicy (CORS) gateway-api/envoy-gateway |
live
|
PASS | scenario.yaml | not yet run |
gateway-api-istio-gateway-api-backend-tls-policy
Istio Gateway API BackendTLSPolicy gateway-api/istio |
live
|
PASS | scenario.yaml | not yet run |
gateway-api-istio-gateway-api-basic
Istio Gateway API Basic gateway-api/istio |
live
|
PASS | scenario.yaml | not yet run |
gateway-api-istio-gateway-api-multi-listener
Istio Gateway API Multi-Listener gateway-api/istio |
live
|
PASS | scenario.yaml | not yet run |
gateway-api-istio-ingress
Istio Gateway API Ingress gateway-api/istio |
live
|
PASS | scenario.yaml | not yet run |
gateway-api-istio-egress
Istio Gateway API Egress gateway-api/istio-egress |
live
|
PASS | scenario.yaml | not yet run |
| Capability / Scenario | Tier | Status | Scenario YAML | Applied Overrides |
|---|---|---|---|---|
ingress-controllers-contour-basic-httpproxy
Contour basic HTTPProxy (gap-probe) networking/contour |
live
|
PASS | scenario.yaml | not yet run |
ingress-controllers-contour-rate-limit
Contour rate limit networking/contour |
live
|
PASS | scenario.yaml | not yet run |
ingress-controllers-contour-tls-delegation
Contour TLS delegation networking/contour |
live
|
PASS | scenario.yaml | not yet run |
networking-kong-ingress
Kong Ingress (className=kong) networking/kong |
live
|
PASS | scenario.yaml | not yet run |
networking-metallb-loadbalancer
MetalLB LoadBalancer (service.type=LoadBalancer) networking/metallb |
live
|
PASS | scenario.yaml | not yet run |
ingress-controllers-nginx-ingress-basic
NGINX Ingress basic routing networking/nginx-ingress |
live
|
PASS | scenario.yaml | not yet run |
ingress-controllers-nginx-ingress-canary
NGINX Ingress canary traffic splitting networking/nginx-ingress |
live
|
PASS | scenario.yaml | not yet run |
ingress-controllers-nginx-ingress-default-backend
NGINX Ingress custom default backend networking/nginx-ingress |
live
|
PASS | scenario.yaml | not yet run |
ingress-controllers-nginx-ingress-snippet-annotations
NGINX Ingress snippet annotations networking/nginx-ingress |
live
|
PASS | scenario.yaml | not yet run |
ingress-controllers-nginx-ingress-tls-cert-manager
NGINX Ingress TLS with cert-manager networking/nginx-ingress |
live
|
PASS | scenario.yaml | not yet run |
ingress-controllers-traefik-basic
Traefik basic IngressRoute networking/traefik |
live
|
PASS | scenario.yaml | not yet run |
ingress-controllers-traefik-ingressroute-crd
Traefik IngressRoute CRD networking/traefik |
live
|
PASS | scenario.yaml | not yet run |
ingress-controllers-traefik-middleware-chain
Traefik middleware chain networking/traefik |
live
|
PASS | scenario.yaml | not yet run |
ingress-controllers-traefik-tls-passthrough
Traefik TLS passthrough networking/traefik |
live
|
PASS | scenario.yaml | not yet run |
networking-traefik-ingress
Traefik Ingress (className=traefik) networking/traefik |
live
|
PASS | scenario.yaml | not yet run |
| Capability / Scenario | Tier | Status | Scenario YAML | Applied Overrides |
|---|---|---|---|---|
networking-aws-lbc-alb-ingress
AWS LBC ALB Ingress networking/ingress-lb/aws-load-balancer-controller |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
networking-aws-lbc-gateway-api
AWS LBC Gateway API networking/ingress-lb/aws-load-balancer-controller |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
networking-aws-lbc-nlb-service
AWS LBC NLB Service networking/ingress-lb/aws-load-balancer-controller |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
networking-azure-lb-agic
Azure LB AGIC Ingress networking/ingress-lb/azure-lb |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
networking-azure-lb-internal
Azure LB Internal networking/ingress-lb/azure-lb |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
networking-azure-lb-public
Azure LB Public networking/ingress-lb/azure-lb |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
networking-gcp-lb-external
GCP LB External HTTP(S) networking/ingress-lb/gcp-lb |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
networking-gcp-lb-gateway-api
GCP LB Gateway API networking/ingress-lb/gcp-lb |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
networking-gcp-lb-internal
GCP LB Internal HTTP(S) networking/ingress-lb/gcp-lb |
authored-only
☁ AUTHORED
|
scenario.yaml | not run |
| Capability / Scenario | Tier | Status | Scenario YAML | Applied Overrides |
|---|---|---|---|---|
policy-kyverno-engine-deny
Kyverno policy-denies-violation: engine-level assert policy/kyverno |
live
|
PASS | scenario.yaml | not yet run |
policy-kyverno-generate
Kyverno generate: ConfigMap in labeled namespaces policy/kyverno |
live
|
PASS | scenario.yaml | not yet run |
policy-kyverno-image-verify
Kyverno image-verify: only approved registries policy/kyverno |
live
|
PASS | scenario.yaml | not yet run |
policy-kyverno-mutate
Kyverno mutate: auto-add annotation to Pods policy/kyverno |
live
|
PASS | scenario.yaml | not yet run |
policy-kyverno-validate
Kyverno validate: require labels on Deployments policy/kyverno |
live
|
PASS | scenario.yaml | not yet run |
customer-b-gatekeeper
Customer B — OPA Gatekeeper admission policies policy/opa-gatekeeper |
live
|
PASS | scenario.yaml | not yet run |
policy-opa-gatekeeper-image-allowlist
OPA Gatekeeper image allowlist enforcement policy/opa-gatekeeper |
live
|
PASS | scenario.yaml | not yet run |
policy-opa-gatekeeper-required-labels
OPA Gatekeeper required labels enforcement (gap-probe) policy/opa-gatekeeper |
live
|
PASS | scenario.yaml | not yet run |
policy-opa-gatekeeper-resource-limits
OPA Gatekeeper resource limits enforcement policy/opa-gatekeeper |
live
|
PASS | scenario.yaml | not yet run |
policy-opa-gatekeeper-sync-config
OPA Gatekeeper sync configuration policy/opa-gatekeeper |
live
|
PASS | scenario.yaml | not yet run |
| Capability / Scenario | Tier | Status | Scenario YAML | Applied Overrides |
|---|---|---|---|---|
customer-a-istio
Customer A — Istio mesh + cert-manager service-mesh/istio |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-istio-ingress-gateway-basic
Istio Ingress Gateway — Basic service-mesh/istio |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-istio-ingress-gateway-jwt
Istio Ingress Gateway — JWT Authentication service-mesh/istio |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-istio-ingress-gateway-multi-host
Istio Ingress Gateway — Multi-Host service-mesh/istio |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-istio-ingress-gateway-request-authentication
Istio Ingress Gateway — RequestAuthentication (No Deny) service-mesh/istio |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-istio-service-mesh-cert-manager-tls
Istio Service Mesh + cert-manager TLS Gateway service-mesh/istio |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-istio-service-mesh-peer-authentication
Istio Service Mesh — PeerAuthentication lifecycle service-mesh/istio |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-istio-service-mesh-sidecar-injection
Istio Service Mesh — Sidecar Injection service-mesh/istio |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-istio-service-mesh-strict-mtls
Istio Service Mesh — strict mTLS service-mesh/istio |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-istio-service-mesh-telemetry-v2
Istio Service Mesh — Telemetry v2 service-mesh/istio |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-istio-sidecar-live
Istio Sidecar Mesh — Live mTLS Verification service-mesh/istio |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-istio-ambient-live
Istio Ambient Mesh — Live mTLS Verification (ztunnel/HBONE) service-mesh/istio-ambient |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-linkerd-basic-mesh
Linkerd — Basic Mesh (Sidecar Injection) service-mesh/linkerd |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-linkerd-live
Linkerd — Live mTLS Sidecar Mesh service-mesh/linkerd |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-linkerd-mtls-rotation
Linkerd — mTLS Identity Rotation service-mesh/linkerd |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-linkerd-multi-cluster-preview
Linkerd — Multi-Cluster Preview service-mesh/linkerd |
live
|
PASS | scenario.yaml | not yet run |
service-mesh-linkerd-service-profile
Linkerd — ServiceProfile (Per-Route Observability) service-mesh/linkerd |
live
|
PASS | scenario.yaml | not yet run |
| Capability / Scenario | Tier | Status | Scenario YAML | Applied Overrides |
|---|---|---|---|---|
subchart-postgres-internal
Internal postgres subchart enabled storage/postgres-subchart |
live
|
PASS | scenario.yaml | applied-overrides.yaml |
| Capability / Scenario | Tier | Status | Scenario YAML | Applied Overrides |
|---|---|---|---|---|
storage-aws-ebs-csi-dynamic
AWS EBS CSI Dynamic Provision storage/csi/aws-ebs-csi |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
storage-aws-ebs-csi-resize
AWS EBS CSI Resize storage/csi/aws-ebs-csi |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
storage-aws-ebs-csi-snapshot
AWS EBS CSI Snapshot storage/csi/aws-ebs-csi |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
storage-azure-disk-csi-dynamic
Azure Disk CSI Dynamic Provision storage/csi/azure-disk-file-csi |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
storage-azure-disk-csi-snapshot
Azure Disk CSI Snapshot storage/csi/azure-disk-file-csi |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
storage-azure-file-csi-shared
Azure File CSI Shared Volume storage/csi/azure-disk-file-csi |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
storage-gcp-pd-csi-dynamic
GCP PD CSI Dynamic Provision storage/csi/gcp-pd-csi |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
storage-gcp-pd-csi-regional
GCP PD CSI Regional PD storage/csi/gcp-pd-csi |
authored-only
☁ AUTHORED
|
scenario.yaml | not run | |
storage-gcp-pd-csi-snapshot
GCP PD CSI Snapshot storage/csi/gcp-pd-csi |
authored-only
☁ AUTHORED
|
scenario.yaml | not run |