Description
The k6 governance resources are unusually well suited to vending because they express a per-team blast-radius cap declaratively, which is rare in this product family. ProjectLimits carries vuhMaxPerMonth, vuMaxPerTest, vuBrowserMaxPerTest and durationMaxPerTest. ProjectAllowedLoadZones allow-lists load zones by identifier.
Vend the project, its limits and its allowed zones. Leave load tests and schedules to the consuming team; test content cannot be inferred from a stack request.
Two verified cautions. Installation is a bootstrap exchange: it takes a stack service account token and a user, and outputs a k6 access token plus organization, so the credential chain differs from Synthetic Monitoring which bootstraps from a Cloud access policy token instead. And the installation resource credential surface churned twice within one upstream release week, with one field added and removed again and another deprecated, so verify the shape against the actual pinned provider rather than upstream documentation.
Private load zones can only be allow-listed, never provisioned, from this provider.
Acceptance Criteria
- #1 Project, limits and allowed load zones are rendered; load tests and schedules are not
- #2 Limits are platform-controlled per usage class and cannot be raised by a request author
- #3 The installation bootstrap is gated on the observed stack service account token and the derived k6 credential is mirrored to the secret store, never the input token
- #4 The installation field shape is verified against the pinned provider CRD rather than upstream docs
- #5 A catalog example renders with placeholder load zone identifiers
Definition of Done
- #1 ./scripts/validate.sh passes locally
- #2 hosted Validate workflow passes on the completing commit
Implementation Plan
Wave 3: root pushes fail-closed seams; assigned lane implements owned files test-first; root audits ownership, integrates documentation and wiring, reviews and validates, verifies signed package publication, pins both references, then finalizes with exact-SHA hosted validation.
Final Summary
Project, platform limits and explicit allowed-zone subset render behind observed bootstrap and derived credential gates. No tests, schedules or private zones are provisioned. Pinned provider Installation CRD and connection mapping were verified; race tests and catalog validation passed. Completing delivery SHA bec9551c3c2abb009a4a50412b33efe47b07520c; hosted Validate 34252640140 success. Root just check passed (85.7% coverage). Signed multi-platform function digest sha256:09ff21ddf5436d0f0165ac7849d86ab4c22a6633551d91ab6aab4edc48f88652 is pinned in both locations. No live provider or deployment proof is claimed.