troubleshoot/examples/preflight/complex-v1beta3.yaml

apiVersion: troubleshoot.sh/v1beta3
kind: Preflight
metadata:
  name: all-analyzers
spec:
  {{- /* Determine if we need explicit collectors beyond always-on clusterResources */}}
  {{- $needExtraCollectors := or (or (or .Values.databases.postgres.enabled .Values.databases.mssql.enabled) (or .Values.databases.mysql.enabled .Values.databases.redis.enabled)) (or (or (or .Values.registryImages.enabled .Values.http.enabled) (or .Values.nodeMetrics.enabled (or .Values.sysctl.enabled .Values.certificates.enabled))) (or (or .Values.goldpinger.enabled .Values.cephStatus.enabled) .Values.longhorn.enabled)) }}

  collectors:
    # Always collect cluster resources to support core analyzers (deployments, secrets, pods, events, etc.)
    - clusterResources: {}

    {{- if .Values.databases.postgres.enabled }}
    - postgres:
        collectorName: '{{ .Values.databases.postgres.collectorName }}'
        uri: '{{ .Values.databases.postgres.uri }}'
        {{- if .Values.databases.postgres.tls }}
        tls:
          skipVerify: {{ .Values.databases.postgres.tls.skipVerify | default false }}
          {{- if .Values.databases.postgres.tls.secret }}
          secret:
            name: '{{ .Values.databases.postgres.tls.secret.name }}'
            namespace: '{{ .Values.databases.postgres.tls.secret.namespace }}'
          {{- end }}
        {{- end }}
    {{- end }}

    {{- if .Values.databases.mssql.enabled }}
    - mssql:
        collectorName: '{{ .Values.databases.mssql.collectorName }}'
        uri: '{{ .Values.databases.mssql.uri }}'
    {{- end }}

    {{- if .Values.databases.mysql.enabled }}
    - mysql:
        collectorName: '{{ .Values.databases.mysql.collectorName }}'
        uri: '{{ .Values.databases.mysql.uri }}'
    {{- end }}

    {{- if .Values.databases.redis.enabled }}
    - redis:
        collectorName: '{{ .Values.databases.redis.collectorName }}'
        uri: '{{ .Values.databases.redis.uri }}'
    {{- end }}

    {{- if .Values.registryImages.enabled }}
    - registryImages:
        collectorName: '{{ .Values.registryImages.collectorName }}'
        namespace: '{{ .Values.registryImages.namespace }}'
        {{- if .Values.registryImages.imagePullSecret }}
        imagePullSecret:
          name: '{{ .Values.registryImages.imagePullSecret.name }}'
          {{- if .Values.registryImages.imagePullSecret.data }}
          data:
            {{- range $k, $v := .Values.registryImages.imagePullSecret.data }}
            {{ $k }}: '{{ $v }}'
            {{- end }}
          {{- end }}
        {{- end }}
        images:
          {{- range .Values.registryImages.images }}
          - '{{ . }}'
          {{- end }}
    {{- end }}

    {{- if .Values.http.enabled }}
    - http:
        collectorName: '{{ .Values.http.collectorName }}'
        {{- if .Values.http.get }}
        get:
          url: '{{ .Values.http.get.url }}'
          {{- if .Values.http.get.timeout }}
          timeout: '{{ .Values.http.get.timeout }}'
          {{- end }}
          {{- if .Values.http.get.insecureSkipVerify }}
          insecureSkipVerify: {{ .Values.http.get.insecureSkipVerify }}
          {{- end }}
          {{- if .Values.http.get.headers }}
          headers:
            {{- range $k, $v := .Values.http.get.headers }}
            {{ $k }}: '{{ $v }}'
            {{- end }}
          {{- end }}
        {{- end }}
        {{- if .Values.http.post }}
        post:
          url: '{{ .Values.http.post.url }}'
          {{- if .Values.http.post.timeout }}
          timeout: '{{ .Values.http.post.timeout }}'
          {{- end }}
          {{- if .Values.http.post.insecureSkipVerify }}
          insecureSkipVerify: {{ .Values.http.post.insecureSkipVerify }}
          {{- end }}
          {{- if .Values.http.post.headers }}
          headers:
            {{- range $k, $v := .Values.http.post.headers }}
            {{ $k }}: '{{ $v }}'
            {{- end }}
          {{- end }}
          {{- if .Values.http.post.body }}
          body: '{{ .Values.http.post.body }}'
          {{- end }}
        {{- end }}
    {{- end }}

    {{- if .Values.nodeMetrics.enabled }}
    - nodeMetrics:
        collectorName: '{{ .Values.nodeMetrics.collectorName }}'
        {{- if .Values.nodeMetrics.nodeNames }}
        nodeNames:
          {{- range .Values.nodeMetrics.nodeNames }}
          - '{{ . }}'
          {{- end }}
        {{- end }}
        {{- if .Values.nodeMetrics.selector }}
        selector:
          {{- range .Values.nodeMetrics.selector }}
          - '{{ . }}'
          {{- end }}
        {{- end }}
    {{- end }}

    {{- if .Values.sysctl.enabled }}
    - sysctl:
        collectorName: 'sysctl'
        namespace: '{{ .Values.sysctl.namespace }}'
        image: '{{ .Values.sysctl.image }}'
        {{- if .Values.sysctl.imagePullPolicy }}
        imagePullPolicy: '{{ .Values.sysctl.imagePullPolicy }}'
        {{- end }}
    {{- end }}

    {{- if .Values.certificates.enabled }}
    - certificates:
        collectorName: 'certs'
        {{- if .Values.certificates.secrets }}
        secrets:
          {{- range .Values.certificates.secrets }}
          - name: '{{ .name }}'
            namespaces:
              {{- range .namespaces }}
              - '{{ . }}'
              {{- end }}
          {{- end }}
        {{- end }}
        {{- if .Values.certificates.configMaps }}
        configMaps:
          {{- range .Values.certificates.configMaps }}
          - name: '{{ .name }}'
            namespaces:
              {{- range .namespaces }}
              - '{{ . }}'
              {{- end }}
          {{- end }}
        {{- end }}
    {{- end }}

    {{- if .Values.longhorn.enabled }}
    - longhorn:
        collectorName: 'longhorn'
        namespace: '{{ .Values.longhorn.namespace }}'
        {{- if .Values.longhorn.timeout }}
        timeout: '{{ .Values.longhorn.timeout }}'
        {{- end }}
    {{- end }}

    {{- if .Values.cephStatus.enabled }}
    - ceph:
        collectorName: 'ceph'
        namespace: '{{ .Values.cephStatus.namespace }}'
        {{- if .Values.cephStatus.timeout }}
        timeout: '{{ .Values.cephStatus.timeout }}'
        {{- end }}
    {{- end }}

    {{- if .Values.goldpinger.enabled }}
    - goldpinger:
        collectorName: '{{ .Values.goldpinger.collectorName }}'
        namespace: '{{ .Values.goldpinger.namespace }}'
        {{- if .Values.goldpinger.collectDelay }}
        collectDelay: '{{ .Values.goldpinger.collectDelay }}'
        {{- end }}
        {{- if .Values.goldpinger.podLaunch }}
        podLaunchOptions:
          {{- if .Values.goldpinger.podLaunch.namespace }}
          namespace: '{{ .Values.goldpinger.podLaunch.namespace }}'
          {{- end }}
          {{- if .Values.goldpinger.podLaunch.image }}
          image: '{{ .Values.goldpinger.podLaunch.image }}'
          {{- end }}
          {{- if .Values.goldpinger.podLaunch.imagePullSecret }}
          imagePullSecret:
            name: '{{ .Values.goldpinger.podLaunch.imagePullSecret.name }}'
          {{- end }}
          {{- if .Values.goldpinger.podLaunch.serviceAccountName }}
          serviceAccountName: '{{ .Values.goldpinger.podLaunch.serviceAccountName }}'
          {{- end }}
        {{- end }}
    {{- end }}

  analyzers:
    {{- if .Values.clusterVersion.enabled }}
    - docString: |
        Title: Kubernetes Control Plane Requirements
        Requirement:
          - Version:
              - Minimum: {{ .Values.clusterVersion.minVersion }}
              - Recommended: {{ .Values.clusterVersion.recommendedVersion }}
        Running below the minimum can remove or alter required GA APIs and lacks critical CVE fixes. The recommended version aligns with CI coverage and provides safer upgrades and operational guidance.
      clusterVersion:
        checkName: Kubernetes version
        outcomes:
          - fail:
              when: '< {{ .Values.clusterVersion.minVersion }}'
              message: Requires at least Kubernetes {{ .Values.clusterVersion.minVersion }}.
          - warn:
              when: '< {{ .Values.clusterVersion.recommendedVersion }}'
              message: Recommended to use Kubernetes {{ .Values.clusterVersion.recommendedVersion }} or later.
          - pass:
              when: '>= {{ .Values.clusterVersion.recommendedVersion }}'
              message: Meets recommended and required Kubernetes versions.
    {{- end }}

    {{- if .Values.storageClass.enabled }}
    - docString: |
        Title: Default StorageClass Requirements
        Requirement:
          - A StorageClass named "{{ .Values.storageClass.className }}" must exist
        A default StorageClass enables dynamic PVC provisioning without manual intervention. Missing or misnamed defaults cause PVCs to remain Pending and block workloads.
      storageClass:
        checkName: Default StorageClass
        storageClassName: '{{ .Values.storageClass.className }}'
        outcomes:
          - fail:
              message: Default StorageClass not found
          - pass:
              message: Default StorageClass present
    {{- end }}

    {{- if .Values.crd.enabled }}
    - docString: |
        Title: Required CRD Presence
        Requirement:
          - CRD must exist: {{ .Values.crd.name }}
        Controllers depending on this CRD cannot reconcile without it, leading to missing resources and degraded functionality.
      customResourceDefinition:
        checkName: Required CRD
        customResourceDefinitionName: '{{ .Values.crd.name }}'
        outcomes:
          - fail:
              message: Required CRD not found
          - pass:
              message: Required CRD present
    {{- end }}

    {{- if .Values.ingress.enabled }}
    - docString: |
        Title: Ingress Object Presence
        Requirement:
          - Ingress exists: {{ .Values.ingress.namespace }}/{{ .Values.ingress.name }}
        Ensures external routing is configured to reach the application. Missing ingress prevents user traffic from reaching services.
      ingress:
        checkName: Ingress exists
        namespace: '{{ .Values.ingress.namespace }}'
        ingressName: '{{ .Values.ingress.name }}'
        outcomes:
          - fail:
              message: Expected ingress not found
          - pass:
              message: Expected ingress present
    {{- end }}

    {{- if .Values.secret.enabled }}
    - docString: |
        Title: Required Secret Presence
        Requirement:
          - Secret exists: {{ .Values.secret.namespace }}/{{ .Values.secret.name }}{{ if .Values.secret.key }} (key: {{ .Values.secret.key }}){{ end }}
        Secrets commonly provide credentials or TLS material. Absence blocks components from authenticating or decrypting traffic.
      secret:
        checkName: Required secret
        namespace: '{{ .Values.secret.namespace }}'
        secretName: '{{ .Values.secret.name }}'
        {{- if .Values.secret.key }}
        key: '{{ .Values.secret.key }}'
        {{- end }}
        outcomes:
          - fail:
              message: Required secret not found
          - pass:
              message: Required secret present
    {{- end }}

    {{- if .Values.configMap.enabled }}
    - docString: |
        Title: Required ConfigMap Presence
        Requirement:
          - ConfigMap exists: {{ .Values.configMap.namespace }}/{{ .Values.configMap.name }}{{ if .Values.configMap.key }} (key: {{ .Values.configMap.key }}){{ end }}
        Required for bootstrapping configuration. Missing keys lead to defaulting or startup failure.
      configMap:
        checkName: Required ConfigMap
        namespace: '{{ .Values.configMap.namespace }}'
        configMapName: '{{ .Values.configMap.name }}'
        {{- if .Values.configMap.key }}
        key: '{{ .Values.configMap.key }}'
        {{- end }}
        outcomes:
          - fail:
              message: Required ConfigMap not found
          - pass:
              message: Required ConfigMap present
    {{- end }}

    {{- if .Values.imagePullSecret.enabled }}
    - docString: |
        Title: Container Registry Credentials
        Requirement:
          - Credentials present for registry: {{ .Values.imagePullSecret.registry }}
        Ensures images can be pulled from private registries. Missing secrets cause ImagePullBackOff and prevent workloads from starting.
      imagePullSecret:
        checkName: Registry credentials
        registryName: '{{ .Values.imagePullSecret.registry }}'
        outcomes:
          - fail:
              message: Cannot pull from registry; credentials missing
          - pass:
              message: Found credentials for registry
    {{- end }}

    {{- if .Values.workloads.deployments.enabled }}
    - docString: |
        Title: Deployment Ready
        Requirement:
          - Deployment ready: {{ .Values.workloads.deployments.namespace }}/{{ .Values.workloads.deployments.name }} (minReady: {{ .Values.workloads.deployments.minReady }})
        Validates rollout completed and enough replicas are Ready to serve traffic.
      deploymentStatus:
        checkName: Deployment ready
        namespace: '{{ .Values.workloads.deployments.namespace }}'
        name: '{{ .Values.workloads.deployments.name }}'
        outcomes:
          - fail:
              when: absent
              message: Deployment not found
          - fail:
              when: '< {{ .Values.workloads.deployments.minReady }}'
              message: Deployment has insufficient ready replicas
          - pass:
              when: '>= {{ .Values.workloads.deployments.minReady }}'
              message: Deployment has sufficient ready replicas
    {{- end }}

    {{- if .Values.workloads.statefulsets.enabled }}
    - docString: |
        Title: StatefulSet Ready
        Requirement:
          - StatefulSet ready: {{ .Values.workloads.statefulsets.namespace }}/{{ .Values.workloads.statefulsets.name }} (minReady: {{ .Values.workloads.statefulsets.minReady }})
        Confirms ordered, persistent workloads have reached readiness before proceeding.
      statefulsetStatus:
        checkName: StatefulSet ready
        namespace: '{{ .Values.workloads.statefulsets.namespace }}'
        name: '{{ .Values.workloads.statefulsets.name }}'
        outcomes:
          - fail:
              when: absent
              message: StatefulSet not found
          - fail:
              when: '< {{ .Values.workloads.statefulsets.minReady }}'
              message: StatefulSet has insufficient ready replicas
          - pass:
              when: '>= {{ .Values.workloads.statefulsets.minReady }}'
              message: StatefulSet has sufficient ready replicas
    {{- end }}

    {{- if .Values.workloads.jobs.enabled }}
    - docString: |
        Title: Job Completion
        Requirement:
          - Job completed: {{ .Values.workloads.jobs.namespace }}/{{ .Values.workloads.jobs.name }}
        Verifies one-off tasks have succeeded; failures indicate setup or migration problems.
      jobStatus:
        checkName: Job completed
        namespace: '{{ .Values.workloads.jobs.namespace }}'
        name: '{{ .Values.workloads.jobs.name }}'
        outcomes:
          - fail:
              when: absent
              message: Job not found
          - fail:
              when: '= 0'
              message: Job has no successful completions
          - pass:
              when: '> 0'
              message: Job completed successfully
    {{- end }}

    {{- if .Values.workloads.replicasets.enabled }}
    - docString: |
        Title: ReplicaSet Ready
        Requirement:
          - ReplicaSet ready: {{ .Values.workloads.replicasets.namespace }}/{{ .Values.workloads.replicasets.name }} (minReady: {{ .Values.workloads.replicasets.minReady }})
        Ensures underlying ReplicaSet has produced the required number of Ready pods for upstream controllers.
      replicasetStatus:
        checkName: ReplicaSet ready
        namespace: '{{ .Values.workloads.replicasets.namespace }}'
        name: '{{ .Values.workloads.replicasets.name }}'
        outcomes:
          - fail:
              message: ReplicaSet is not ready
          - pass:
              when: '>= {{ .Values.workloads.replicasets.minReady }}'
              message: ReplicaSet has sufficient ready replicas
    {{- end }}

    {{- if .Values.clusterPodStatuses.enabled }}
    - docString: |
        Title: Cluster Pod Readiness by Namespace
        Requirement:
          - Namespaces checked: {{ toYaml .Values.clusterPodStatuses.namespaces | nindent 10 }}
        Highlights unhealthy pods across critical namespaces to surface rollout or configuration issues.
      clusterPodStatuses:
        checkName: Pod statuses
        namespaces: {{ toYaml .Values.clusterPodStatuses.namespaces | nindent 8 }}
        outcomes:
          - warn:
              message: Some pods are not ready
          - pass:
              message: All pods are ready
    {{- end }}

    {{- if .Values.clusterContainerStatuses.enabled }}
    - docString: |
        Title: Container Restart Thresholds
        Requirement:
          - Namespaces checked: {{ toYaml .Values.clusterContainerStatuses.namespaces | nindent 10 }}
          - Restart threshold: {{ .Values.clusterContainerStatuses.restartCount }}
        Elevated restart counts often indicate crash loops, resource pressure, or image/runtime issues.
      clusterContainerStatuses:
        checkName: Container restarts
        namespaces: {{ toYaml .Values.clusterContainerStatuses.namespaces | nindent 8 }}
        restartCount: {{ .Values.clusterContainerStatuses.restartCount }}
        outcomes:
          - warn:
              message: One or more containers exceed restart threshold
          - pass:
              message: Container restarts are within thresholds
    {{- end }}

    {{- if .Values.containerRuntime.enabled }}
    - docString: |
        Title: Container Runtime Compatibility
        Requirement:
          - Runtime must be: containerd
        containerd with CRI provides stable semantics; other runtimes are unsupported and may break image, cgroup, and networking expectations.
      containerRuntime:
        checkName: Runtime must be containerd
        outcomes:
          - pass:
              when: '== containerd'
              message: containerd runtime detected
          - fail:
              message: Unsupported container runtime; containerd required
    {{- end }}

    {{- if .Values.distribution.enabled }}
    - docString: |
        Title: Supported Kubernetes Distributions
        Requirement:
          - Unsupported: {{ toYaml .Values.distribution.unsupported | nindent 12 }}
          - Supported: {{ toYaml .Values.distribution.supported | nindent 12 }}
        Production-tier assumptions (RBAC, admission, networking, storage) are validated on supported distros. Unsupported environments commonly diverge and reduce reliability.
      distribution:
        checkName: Supported distribution
        outcomes:
          {{- range $d := .Values.distribution.unsupported }}
          - fail:
              when: '== {{ $d }}'
              message: '{{ $d }} is not supported'
          {{- end }}
          {{- range $d := .Values.distribution.supported }}
          - pass:
              when: '== {{ $d }}'
              message: '{{ $d }} is a supported distribution'
          {{- end }}
          - warn:
              message: Unable to determine the distribution
    {{- end }}

    {{- if .Values.nodeResources.count.enabled }}
    - docString: |
        Title: Node Count Requirement
        Requirement:
          - Minimum nodes: {{ .Values.nodeResources.count.min }}
          - Recommended nodes: {{ .Values.nodeResources.count.recommended }}
        Ensures capacity and disruption tolerance for upgrades and failures; too few nodes yields scheduling pressure and risk during maintenance.
      nodeResources:
        checkName: Node count
        outcomes:
          - fail:
              when: 'count() < {{ .Values.nodeResources.count.min }}'
              message: Requires at least {{ .Values.nodeResources.count.min }} nodes
          - warn:
              when: 'count() < {{ .Values.nodeResources.count.recommended }}'
              message: Recommended at least {{ .Values.nodeResources.count.recommended }} nodes
          - pass:
              message: Cluster has sufficient nodes
    {{- end }}

    {{- if .Values.nodeResources.cpu.enabled }}
    - docString: |
        Title: Cluster CPU Capacity
        Requirement:
          - Total vCPU minimum: {{ .Values.nodeResources.cpu.min }}
        Aggregate CPU must cover control plane, system daemons, and application workloads; insufficient CPU causes scheduling delays and degraded throughput.
      nodeResources:
        checkName: Cluster CPU total
        outcomes:
          - fail:
              when: 'sum(cpuCapacity) < {{ .Values.nodeResources.cpu.min }}'
              message: Requires at least {{ .Values.nodeResources.cpu.min }} cores
          - pass:
              message: Cluster CPU capacity meets requirement
    {{- end }}

    {{- if .Values.nodeResources.memory.enabled }}
    - docString: |
        Title: Per-node Memory Requirement
        Requirement:
          - Minimum per-node: {{ .Values.nodeResources.memory.minGi }} GiB
          - Recommended per-node: {{ .Values.nodeResources.memory.recommendedGi }} GiB
        Memory headroom avoids OOMKills and evictions during spikes and upgrades; recommended capacity supports stable operations.
      nodeResources:
        checkName: Per-node memory
        outcomes:
          - fail:
              when: 'min(memoryCapacity) < {{ .Values.nodeResources.memory.minGi }}Gi'
              message: All nodes must have at least {{ .Values.nodeResources.memory.minGi }} GiB
          - warn:
              when: 'min(memoryCapacity) < {{ .Values.nodeResources.memory.recommendedGi }}Gi'
              message: Recommended {{ .Values.nodeResources.memory.recommendedGi }} GiB per node
          - pass:
              message: All nodes meet recommended memory
    {{- end }}

    {{- if .Values.nodeResources.ephemeral.enabled }}
    - docString: |
        Title: Per-node Ephemeral Storage Requirement
        Requirement:
          - Minimum per-node: {{ .Values.nodeResources.ephemeral.minGi }} GiB
          - Recommended per-node: {{ .Values.nodeResources.ephemeral.recommendedGi }} GiB
        Ephemeral storage backs images, container filesystems, and logs; insufficient capacity triggers disk pressure and failed pulls.
      nodeResources:
        checkName: Per-node ephemeral storage
        outcomes:
          - fail:
              when: 'min(ephemeralStorageCapacity) < {{ .Values.nodeResources.ephemeral.minGi }}Gi'
              message: All nodes must have at least {{ .Values.nodeResources.ephemeral.minGi }} GiB
          - warn:
              when: 'min(ephemeralStorageCapacity) < {{ .Values.nodeResources.ephemeral.recommendedGi }}Gi'
              message: Recommended {{ .Values.nodeResources.ephemeral.recommendedGi }} GiB per node
          - pass:
              message: All nodes meet recommended ephemeral storage
    {{- end }}

    {{- if .Values.textAnalyze.enabled }}
    - docString: |
        Title: Text Analyze Pattern Check
        Requirement:
          - File(s): {{ .Values.textAnalyze.fileName }}
          - Regex: {{ .Values.textAnalyze.regex }}
        Surfaces error patterns in collected logs or text files that indicate configuration or runtime issues.
      textAnalyze:
        checkName: Text analyze
        collectorName: 'cluster-resources'
        fileName: '{{ .Values.textAnalyze.fileName }}'
        regex: '{{ .Values.textAnalyze.regex }}'
        ignoreIfNoFiles: true
        outcomes:
          - fail:
              message: Pattern matched in files
          - pass:
              message: Pattern not found
    {{- end }}

    {{- if .Values.yamlCompare.enabled }}
    - docString: |
        Title: YAML Field Comparison
        Requirement:
          - File: {{ .Values.yamlCompare.fileName }}
          - Path: {{ .Values.yamlCompare.path }}
          - Expected: {{ .Values.yamlCompare.value }}
        Validates rendered object fields match required configuration to ensure correct behavior.
      yamlCompare:
        checkName: YAML compare
        collectorName: 'cluster-resources'
        fileName: '{{ .Values.yamlCompare.fileName }}'
        path: '{{ .Values.yamlCompare.path }}'
        value: '{{ .Values.yamlCompare.value }}'
        outcomes:
          - fail:
              message: YAML value does not match expected
          - pass:
              message: YAML value matches expected
    {{- end }}

    {{- if .Values.jsonCompare.enabled }}
    - docString: |
        Title: JSON Field Comparison
        Requirement:
          - File: {{ .Values.jsonCompare.fileName }}
          - JSONPath: {{ .Values.jsonCompare.jsonPath }}
          - Expected: {{ .Values.jsonCompare.value }}
        Ensures collected JSON metrics or resources match required values.
      jsonCompare:
        checkName: JSON compare
        collectorName: 'cluster-resources'
        fileName: '{{ .Values.jsonCompare.fileName }}'
        jsonPath: '{{ .Values.jsonCompare.jsonPath }}'
        value: '{{ .Values.jsonCompare.value }}'
        outcomes:
          - fail:
              message: JSON value does not match expected
          - pass:
              message: JSON value matches expected
    {{- end }}

    {{- if .Values.databases.postgres.enabled }}
    - docString: |
        Title: Postgres Connectivity and Health
        Requirement:
          - Collector: {{ .Values.databases.postgres.collectorName }}
        Validates database availability and credentials to avoid boot failures or runtime errors.
      postgres:
        checkName: Postgres checks
        collectorName: '{{ .Values.databases.postgres.collectorName }}'
        outcomes:
          - fail:
              message: Postgres checks failed
          - pass:
              message: Postgres checks passed
    {{- end }}

    {{- if .Values.databases.mssql.enabled }}
    - docString: |
        Title: MSSQL Connectivity and Health
        Requirement:
          - Collector: {{ .Values.databases.mssql.collectorName }}
        Ensures connectivity and credentials to Microsoft SQL Server are valid prior to workload startup.
      mssql:
        checkName: MSSQL checks
        collectorName: '{{ .Values.databases.mssql.collectorName }}'
        outcomes:
          - fail:
              message: MSSQL checks failed
          - pass:
              message: MSSQL checks passed
    {{- end }}

    {{- if .Values.databases.mysql.enabled }}
    - docString: |
        Title: MySQL Connectivity and Health
        Requirement:
          - Collector: {{ .Values.databases.mysql.collectorName }}
        Verifies MySQL reachability and credentials to prevent configuration-time failures.
      mysql:
        checkName: MySQL checks
        collectorName: '{{ .Values.databases.mysql.collectorName }}'
        outcomes:
          - fail:
              message: MySQL checks failed
          - pass:
              message: MySQL checks passed
    {{- end }}

    {{- if .Values.databases.redis.enabled }}
    - docString: |
        Title: Redis Connectivity and Health
        Requirement:
          - Collector: {{ .Values.databases.redis.collectorName }}
        Validates cache availability; failures cause timeouts, degraded performance, or startup errors.
      redis:
        checkName: Redis checks
        collectorName: '{{ .Values.databases.redis.collectorName }}'
        outcomes:
          - fail:
              message: Redis checks failed
          - pass:
              message: Redis checks passed
    {{- end }}

    {{- if .Values.cephStatus.enabled }}
    - docString: |
        Title: Ceph Cluster Health
        Requirement:
          - Namespace: {{ .Values.cephStatus.namespace }}
        Ensures Ceph reports healthy status before depending on it for storage operations.
      cephStatus:
        checkName: Ceph cluster health
        namespace: '{{ .Values.cephStatus.namespace }}'
        outcomes:
          - fail:
              message: Ceph is not healthy
          - pass:
              message: Ceph is healthy
    {{- end }}

    {{- if .Values.velero.enabled }}
    - docString: |
        Title: Velero Installed
        Requirement:
          - Velero controllers installed and discoverable
        Backup/restore operations require Velero components to be present.
      velero:
        checkName: Velero installed
    {{- end }}

    {{- if .Values.longhorn.enabled }}
    - docString: |
        Title: Longhorn Health
        Requirement:
          - Namespace: {{ .Values.longhorn.namespace }}
        Verifies Longhorn is healthy to ensure persistent volumes remain available and replicas are in sync.
      longhorn:
        checkName: Longhorn health
        namespace: '{{ .Values.longhorn.namespace }}'
        outcomes:
          - fail:
              message: Longhorn is not healthy
          - pass:
              message: Longhorn is healthy
    {{- end }}

    {{- if .Values.registryImages.enabled }}
    - docString: |
        Title: Registry Image Availability
        Requirement:
          - Collector: {{ .Values.registryImages.collectorName }}
          - Images: {{ toYaml .Values.registryImages.images | nindent 12 }}
        Ensures required images are available and pullable with provided credentials.
      registryImages:
        checkName: Registry image availability
        collectorName: '{{ .Values.registryImages.collectorName }}'
        outcomes:
          - fail:
              message: One or more images are not available
          - pass:
              message: All images are available
    {{- end }}

    {{- if .Values.weaveReport.enabled }}
    - docString: |
        Title: Weave Net Report Presence
        Requirement:
          - Report files: {{ .Values.weaveReport.reportFileGlob }}
        Validates networking diagnostics are collected for analysis of connectivity issues.
      weaveReport:
        checkName: Weave report
        reportFileGlob: '{{ .Values.weaveReport.reportFileGlob }}'
    {{- end }}

    {{- if .Values.sysctl.enabled }}
    - docString: |
        Title: Sysctl Settings Validation
        Requirement:
          - Namespace: {{ .Values.sysctl.namespace }}
          - Image: {{ .Values.sysctl.image }}
        Checks kernel parameter configuration that impacts networking, file descriptors, and memory behavior.
      sysctl:
        checkName: Sysctl settings
        outcomes:
          - warn:
              message: One or more sysctl values do not meet recommendations
          - pass:
              message: Sysctl values meet recommendations
    {{- end }}

    {{- if .Values.clusterResource.enabled }}
    - docString: |
        Title: Cluster Resource Field Requirement
        Requirement:
          - Kind: {{ .Values.clusterResource.kind }}
          - Name: {{ .Values.clusterResource.name }}{{ if not .Values.clusterResource.clusterScoped }} (ns: {{ .Values.clusterResource.namespace }}){{ end }}
          - YAML path: {{ .Values.clusterResource.yamlPath }}{{ if .Values.clusterResource.expectedValue }} (expected: {{ .Values.clusterResource.expectedValue }}){{ end }}
        Ensures critical configuration on a Kubernetes object matches expected value to guarantee correct behavior.
      clusterResource:
        checkName: Cluster resource value
        kind: '{{ .Values.clusterResource.kind }}'
        clusterScoped: {{ .Values.clusterResource.clusterScoped }}
        {{- if not .Values.clusterResource.clusterScoped }}
        namespace: '{{ .Values.clusterResource.namespace }}'
        {{- end }}
        name: '{{ .Values.clusterResource.name }}'
        yamlPath: '{{ .Values.clusterResource.yamlPath }}'
        {{- if .Values.clusterResource.expectedValue }}
        expectedValue: '{{ .Values.clusterResource.expectedValue }}'
        {{- end }}
        {{- if .Values.clusterResource.regex }}
        regex: '{{ .Values.clusterResource.regex }}'
        {{- end }}
        outcomes:
          - fail:
              message: Cluster resource field does not match expected value
          - pass:
              message: Cluster resource field matches expected value
    {{- end }}

    {{- if .Values.certificates.enabled }}
    - docString: |
        Title: Certificates Validity and Expiry
        Requirement:
          - Check certificate material in referenced secrets/configmaps
        Identifies expired or soon-to-expire certificates that would break TLS handshakes.
      certificates:
        checkName: Certificates validity
        outcomes:
          - warn:
              message: One or more certificates may be invalid or expiring soon
          - pass:
              message: Certificates are valid
    {{- end }}

    {{- if .Values.goldpinger.enabled }}
    - docString: |
        Title: Goldpinger Network Health
        Requirement:
          - Collector: {{ .Values.goldpinger.collectorName }}
          - Report path: {{ .Values.goldpinger.filePath }}
        Uses Goldpinger probes to detect DNS, network, and kube-proxy issues across the cluster.
      goldpinger:
        checkName: Goldpinger report
        collectorName: '{{ .Values.goldpinger.collectorName }}'
        filePath: '{{ .Values.goldpinger.filePath }}'
        outcomes:
          - fail:
              message: Goldpinger indicates network issues
          - pass:
              message: Goldpinger indicates healthy networking
    {{- end }}

    {{- if .Values.event.enabled }}
    - docString: |
        Title: Kubernetes Events Scan
        Requirement:
          - Namespace: {{ .Values.event.namespace }}
          - Reason: {{ .Values.event.reason }}{{ if .Values.event.kind }} (kind: {{ .Values.event.kind }}){{ end }}{{ if .Values.event.regex }} (regex: {{ .Values.event.regex }}){{ end }}
        Surfaces critical events that often correlate with configuration issues, crash loops, or cluster instability.
      event:
        checkName: Events
        collectorName: '{{ .Values.event.collectorName }}'
        namespace: '{{ .Values.event.namespace }}'
        {{- if .Values.event.kind }}
        kind: '{{ .Values.event.kind }}'
        {{- end }}
        reason: '{{ .Values.event.reason }}'
        {{- if .Values.event.regex }}
        regex: '{{ .Values.event.regex }}'
        {{- end }}
        outcomes:
          - fail:
              when: 'true'
              message: Critical events detected
          - pass:
              when: 'false'
              message: No critical events detected
    {{- end }}

    {{- if .Values.nodeMetrics.enabled }}
    - docString: |
        Title: Node Metrics Thresholds
        Requirement:
          - Filters: PVC nameRegex={{ .Values.nodeMetrics.filters.pvc.nameRegex }}{{ if .Values.nodeMetrics.filters.pvc.namespace }}, namespace={{ .Values.nodeMetrics.filters.pvc.namespace }}{{ end }}
        Evaluates node-level metrics to detect capacity pressure and performance bottlenecks.
      nodeMetrics:
        checkName: Node metrics thresholds
        collectorName: '{{ .Values.nodeMetrics.collectorName }}'
        {{- if .Values.nodeMetrics.filters.pvc.nameRegex }}
        filters:
          pvc:
            nameRegex: '{{ .Values.nodeMetrics.filters.pvc.nameRegex }}'
            {{- if .Values.nodeMetrics.filters.pvc.namespace }}
            namespace: '{{ .Values.nodeMetrics.filters.pvc.namespace }}'
            {{- end }}
        {{- end }}
        outcomes:
          - warn:
              message: Node metrics exceed warning thresholds
          - pass:
              message: Node metrics within thresholds
    {{- end }}

    {{- if .Values.http.enabled }}
    - docString: |
        Title: HTTP Endpoint Health Checks
        Requirement:
          - Collected results: {{ .Values.http.collectorName }}
        Validates availability of service HTTP endpoints used by the application.
      http:
        checkName: HTTP checks
        collectorName: '{{ .Values.http.collectorName }}'
        outcomes:
          - fail:
              message: One or more HTTP checks failed
          - pass:
              message: All HTTP checks passed
    {{- end }}