TL;DR. On top of part 2's offline render tests I added two Kyverno Chainsaw layers. One applies every composition to a throwaway kind cluster with no cloud credentials on every pull request, so nothing real gets created. The other applies the same use cases with real credentials to a prod-like environment, which mirrors production but can run a branch, and waits for Ready and verified cloud state. A third job upgrades existing composite resources (XRs) to the PR's compositions. I chose Chainsaw over Uptest, and the new layers found real bugs that every render test had passed.

This is an opinionated write-up of what worked for me as a solo DevOps engineer, in one company's setup.…