Add an unconditional fourth HTTPS listener (`https-dizzy`) on the shared
port 443 of the kind Gateway, routed by SNI to `dizzy.127-0-0-1.nip.io`
for the opt-in dizzy observability overlay's Grafana UI. This is the
repo's first listener that admits routes from another namespace, keyed
by the automatic `kubernetes.io/metadata.name` label, so the gated
overlay's static `dizzy-grafana` HTTPRoute attaches from the `dizzy`
namespace without introducing a ReferenceGrant. The route ships only in
the gated overlay, so with WITH_DIZZY unset no route attaches and the
SNI answers 404, mirroring how the glance listener exists without a
Glance service. A per-hostname self-signed Certificate mirrors the
keystone/horizon/glance siblings and terminates the `https-dizzy`
listener with its own `dizzy-nip-io-tls` key material.

On-behalf-of: @SAP
Assisted-by: Claude:claude-fable-5
Signed-off-by: Christian Berendt <berendt@23technologies.cloud>

Add hack/dizzy.sh, an opt-in wrapper around the dizzy load/chaos
tester with two subcommands. The dizzy version is pinned exactly
once via DIZZY_VERSION so a Renovate regex can bump it. Both
subcommands share a tarball cache under _output/dizzy/ that fetches,
extracts, and atomically renames the release tree into place, so an
aborted download never leaves a half-populated cache.

stage-dashboards copies dizzy's three Grafana dashboards into
deploy/kind/dizzy/dashboards/ for the kind overlay's
configMapGenerator. The chaos subcommand accepts keystone or glance,
installs the binary via a buildinfo-guarded go install, and generates
a mode-600 clouds.yaml from the ControlPlane admin Secret, keeping the
missing-Secret and empty-password aborts distinct. It resolves the
Keystone auth URL from a docker port probe with a :443 fallback,
warns without aborting when the OTLP ingest path looks down, pins the
OTLP metric export interval to 15s, passes DIZZY_ARGS through, and
propagates dizzy's own exit code.

On-behalf-of: @SAP
Assisted-by: Claude:claude-fable-5
Signed-off-by: Christian Berendt <berendt@23technologies.cloud>

The dizzy overlay is a self-contained kind addon (kustomize
LoadRestrictionsRootOnly, no parent-directory refs) applied only when
WITH_DIZZY=true make deploy-infra opts in. It declares two
HelmRepositories into flux-system from within the overlay, leaving
deploy/flux-system/** untouched. VictoriaMetrics-single ingests the
dizzy tester's OTLP metrics with Prometheus-naming and
promote-all-resource-attributes extraArgs, exposed on NodePort 30428
with emptyDir storage and a 30d retention window (kind-only throwaway
posture). An anonymous-Viewer Grafana is provisioned with the
victoriametrics datasource and a dashboards ConfigMap wrapping the
three staged dizzy dashboards. The repo's first static HTTPRoute
attaches the Grafana Service to the https-dizzy Gateway listener at
https://dizzy.127-0-0-1.nip.io. The git-ignored dashboards/ staging
directory is populated by hack/dizzy.sh stage-dashboards before
kustomize build resolves the configMapGenerator files. Chart values
were verified with helm template/show values against
victoria-metrics-single 0.43.0 and grafana 10.5.15; the only
correction was moving fullnameOverride to the top level so the server
Service renders as dizzy-victoria-metrics-server, matching the Grafana
datasource URL.

On-behalf-of: @SAP
Assisted-by: Claude:claude-fable-5
Signed-off-by: Christian Berendt <berendt@23technologies.cloud>

Add a WITH_DIZZY opt-in flag to deploy-infra.sh, cloned from the
WITH_PROMETHEUS pattern, so the kind Quick Start stays minimal by
default and only installs the dizzy VictoriaMetrics + Grafana overlay
when explicitly requested. The flag defaults to false and surfaces in
the startup banner next to its siblings.

When enabled, Step 3 stages the pinned dizzy Grafana dashboard JSONs via
hack/dizzy.sh stage-dashboards immediately before applying the
self-contained deploy/kind/dizzy overlay, then probes the control-plane
node for the host 8428 to NodePort 30428 OTLP ingest mapping and warns
without aborting when the cluster predates it. Phase 3 appends
dizzy-victoria-metrics and dizzy-grafana to the HelmRelease wait list,
and a post-wait log prints the Grafana URL, honoring a KIND_HOST_PORT
override.

On-behalf-of: @SAP
Assisted-by: Claude:claude-fable-5
Signed-off-by: Christian Berendt <berendt@23technologies.cloud>

Add two thin wrappers over `hack/dizzy.sh chaos <service>` that run the
dizzy chaos churn soak against the quick-start ControlPlane. Each target
runs three separated preflights — kubectl reachability, dizzy stack
presence, and ControlPlane admin Secret — so the failure modes stay
distinguishable instead of collapsing into one opaque error. The
preflights honor the same DIZZY_SECRET/DIZZY_CP_NAMESPACE overrides as
the script, and the version pin stays in hack/dizzy.sh only so Renovate
has exactly one string to bump.

On-behalf-of: @SAP
Assisted-by: Claude:claude-fable-5
Signed-off-by: Christian Berendt <berendt@23technologies.cloud>

Add a regex customManager over the single DIZZY_VERSION pin line so
Renovate keeps it current, resolving updates from the github-releases
datasource for B42Labs/dizzy. Major bumps stay disabled while minor
and patch updates automerge after the standard 3-day cooldown, matching
the other hack-script pins. A regression test perl-evaluates the
matchString regex against the real script and compares the capture with
the literal pin, so any regex/script drift fails fast.

On-behalf-of: @SAP
Assisted-by: Claude:claude-fable-5
Signed-off-by: Christian Berendt <berendt@23technologies.cloud>

Add three tests that pin the opt-in dizzy stack (VictoriaMetrics +
Grafana) so its default-off posture cannot regress silently.

The flag test locks the default-off gate count (three strict
WITH_DIZZY=="true" gates), the configuration banner, the staged-apply
ordering (dizzy.sh stage-dashboards before kubectl apply -k, under the
same gate), the Phase 3 helm_releases append, and the byte-for-byte
survival of the 8428 -> 30428 OTLP ingest mapping under a KIND_HOST_PORT
override.

The overlay test pins the SPDX headers on all seven tracked files, the
exact rendered resource set (one Namespace, two HelmRepositories, two
HelmReleases, one HTTPRoute, one dashboards ConfigMap), and the
fail-when-unstaged staging contract, while moving any developer-staged
dashboards aside and restoring them via an EXIT trap.

The chainsaw suite asserts the dizzy Namespace, sources, and releases
are absent on a default-flags cluster, mirroring the
no-metrics-server-when-disabled suite.

On-behalf-of: @SAP
Assisted-by: Claude:claude-fable-5
Signed-off-by: Christian Berendt <berendt@23technologies.cloud>

Add an opt-in tip and two architecture-snapshot pod rows to the
extended quick start covering WITH_DIZZY=true make deploy-infra.
Document the deploy/kind/dizzy/ overlay in the infrastructure-manifests
reference: the seven tracked files, the dashboard staging contract, the
always-present https-dizzy listener and Certificate versus the
overlay-gated HTTPRoute, and the 8428 to 30428 host port mapping. Add a
dizzy-chaos-testing reference page for the make dizzy-keystone and make
dizzy-glance runners, covering the environment overrides, the Grafana
dashboards, the exported metric families, and the two troubleshooting
warnings. Wire the new page into the Testing sidebar group.

On-behalf-of: @SAP
Assisted-by: Claude:claude-fable-5
Signed-off-by: Christian Berendt <berendt@23technologies.cloud>