Break Kubernetes on purpose

Pick a fault, state what you expect to stay true, and watch whether it holds. The cluster below runs in your browser — no cluster, no credentials, nothing to install. When you want the real thing, switch to live mode and the same experiment is dispatched at your own cluster through GitHub Actions.

Live mode dispatches real faults at a real cluster. It needs KUBECONFIG_DATA and CLUSTER_CONTEXT as repository secrets, plus a fine-grained token with Actions write access, entered below. The token is held in this browser tab only — it is never stored in the page, in the repository, or anywhere else. Setup guide
Cluster three worker nodes, one zone each
t+0s
4 ready — p95 — errors
p95 latency error rate ready pods
Fault

Experiment
kube-system and other control-plane namespaces are refused
Hypothesiswhat should stay true

An experiment without a hypothesis is just an outage. State the steady state you expect to survive the fault; the run is graded against it and stopped if it breaks.

Stop the moment it breaks
Removes the fault and rolls the namespace back rather than riding out the full duration.
An external URL, or svc:name:port/path to probe through a port-forward from inside the cluster. Leave empty to grade on ready pods alone.
Workload change the posture and run the same fault again
Capacity
0 means no budget
0 means unlimited
0 means unlimited
Behaviour
Readiness probe
Holds traffic back until a new pod can actually serve it.
Liveness probe
Restarts a container that has stopped responding.
Horizontal autoscaler
Adds replicas when cluster CPU passes 70%, up to eight.
Topology spread
Keeps replicas balanced across zones instead of stacking them.
GitHubthis browser tab only
Fork the repository and point this at your own copy.
Needs Actions: write on that repository only. Kept in this tab's session storage and cleared when you close it.
Open Actions Simulated time runs at 8× — a 60 second experiment takes about 8 seconds.
—
Incident report — the writeup you would have produced if this failure had happened on its own. 

    

  


  
  
Log

  

    

      
      chaoslab
      idle
    

    

  


  
  
Guardrails

  

    
Protected namespaces
Experiments are refused against kube-system, kube-public, kube-node-lease, cert-manager, istio-system and gatekeeper-system. Whitespace and casing tricks are stripped before the check, and setting the CHAOS_ALLOWED_NAMESPACES repository variable narrows it further to an allowlist.

    
Bounded blast radius
Pod-level faults hit a random sample capped at the percentage you choose. Node-level faults are pinned by node affinity to the nodes already hosting your target pods, and never to a control-plane node.

    
Abort on breach
The hypothesis is re-evaluated every ten seconds during a live run. The first breach removes the fault and triggers a full rollback rather than waiting out the duration.

    
Cleanup that survives failure
Removal runs on success, failure, timeout and cancellation. Network emulation carries a signal trap and a follow-up scrub job, so a node is never left with a stray tc queue.

    
One experiment at a time
Runs are serialised per namespace by a concurrency group. Overlapping faults produce results nobody can attribute to a cause.

    
Approval before live
Live runs execute in the chaos-live environment. Add required reviewers to it and every real experiment waits for a human before it starts.