Testing · 02 of 03 · In Hangar

One test run in Hangar

The app team writes one file. Glidepath does the rest: it moves the secrets in for the length of the run, applies the workflow through a policy gate, and puts the result where people already look.

One test run in Hangar Four zones. The app repo holds cicd.yaml, which turns the test stage on and names the test (integration), and glidepath/integration.yaml, a TestWorkflow the team owns. Glidepath's run-testworkflow Task takes four steps: copy the app's secrets into the shared testkube namespace, rewrite the workflow's name and apply it, run it with the testkube CLI and poll, and blank the secret again. In the shared testkube namespace, a Kyverno admission policy, drawn as a security boundary, only lets the workflow reference the app's own secret, or denies it. The admitted TestWorkflow is named after the app and the test, and Testkube CE, with no control plane, runs the pods. Below, where people see it: the Task's results (an outcome and one line per step) are shown in the Release Record in Tower, beside the build, and the stage emits an OpenTelemetry span, a CDEvent and a Slack notification. THE APP REPOGLIDEPATH · RUN-TESTWORKFLOWTESTKUBE NAMESPACE · SHAREDWHERE PEOPLE SEE ITcicd.yamltest: enabled · name: integrationglidepath/integration.yamla TestWorkflow the team owns1 Copy app secrets into testkube2 Rewrite the name, then apply3 Run with the testkube CLI, poll4 Blank the secret againKyverno admissionyour own secret, or deniedTestWorkflowname: <app>-integrationAgent runs the podsTestkube CE · no control planeTask resultsoutcome · one line per stepRelease Recordin Tower, beside the buildStage span and notifyOTel trace · CDEvent · SlackThe team owns the test. The platform owns the fence around it.LEGENDWritten by the teamPlatform stepPolicyWhat matters mostApplyRunShown in

Self-service

A new test is a file in the app repo, next to cicd.yaml. No ticket, no operator, and the name can't collide with another app's.

Fenced

Kyverno checks every TestWorkflow at admission, while the caller's real identity is still visible. One app's tests can't mount another app's secrets.

Not only tests

A TestWorkflow is anything that runs and reports pass or fail. Warming a cache before a release fits just as well as a Playwright suite.

Hangar · Glidepath · Testing