Chaos Mesh

Chaos Mesh is a free, open-source Chaos Engineering platform for simulating faults in development, testing, and production environments. It runs on Kubernetes and manages experiments through CustomResourceDefinitions and the Kubernetes API. Supported fault areas include Pods, networks, DNS, HTTP, I/O, time, stress, kernels, block devices, JVMs, physical machines, and AWS, Azure, and GCP. Schedule, Workflow, and StatusCheck resources support recurring experiments, serial or parallel runs, and application health checks. Selectors and namespace controls help scope experiments to chosen targets. Chaos Dashboard provides a web interface and HTTP API for creating, managing, and observing experiments, with role-based access control enabled by default. Chaos Daemon runs as a privileged Kubernetes DaemonSet by default, although that permission can be disabled. The software is licensed under Apache License 2.0, and its Helm repository supports Helm 3. Kubernetes compatibility depends on release: version 2.8 supports Kubernetes 1.30 through 1.35, while 2.7 supports 1.26 through 1.28. Community technical support is available through CNCF Slack and GitHub Discussions.

Chaos Mesh offers Kubernetes-based fault simulation with scheduling, workflow, and scope controls. Teams should account for its privileged daemon default, dashboard persistence requirements, and version-specific Kubernetes compatibility.

Chaos Mesh suits teams running Kubernetes that want to orchestrate fault simulations and check application health. Its documented release-specific Kubernetes support is important when choosing a version.

Chaos Mesh is a free, open-source fault-injection platform for Kubernetes teams. It is best suited to operators who want to manage and coordinate experiments through cluster resources. Its breadth and scope controls are valuable, but the privileged daemon and careful deployment requirements make it a considered choice.

Overview

Chaos Mesh defines experiments as Kubernetes CustomResourceDefinitions and manages them through the Kubernetes API. That makes it a natural fit for teams already operating Kubernetes, rather than organizations seeking a standalone testing service. Its fault coverage ranges from Pods, networks, DNS, HTTP, I/O, time, stress, kernels, block devices, JVMs, and physical machines to AWS, Azure, and GCP.

Selectors and namespace controls help teams confine experiments to chosen targets, an important safeguard when injecting faults into shared or production environments. For Pod Kill experiments, a ReplicaSet or similar controller should be configured so a killed Pod can restart automatically.

Key features

Scheduling and orchestration

Schedule resources enable recurring experiments. Workflow resources coordinate experiments in sequence or in parallel and can check their status and results, while StatusCheck resources provide application health checks. This gives teams a way to make fault exercises repeatable and coordinated; it also means workflows and their target scope need to be designed with the same care as the experiments themselves.

Dashboard and integrations

Chaos Dashboard offers a web interface and HTTP API for creating, managing, and observing experiments. Role-based access control restricts dashboard operations by default. On Google Cloud Platform, the dashboard can use Google OAuth authentication. Its SQLite database needs a persistent volume if data must survive a reboot; MySQL or PostgreSQL are alternatives for dashboard storage.

The chaos-mesh-action GitHub Action connects experiments to GitHub Actions CI workflows. The Grafana data-source plugin requires Chaos Mesh 2.1 or later and Grafana 10.0 or later; it was tested on Grafana 10.0.3. RemoteCluster can install components in remote Kubernetes clusters and synchronize experiment status, though the feature remains at an early stage.

Security and compatibility

Chaos Mesh uses Kubernetes RBAC, and namespace annotations can restrict where experiments are enabled. The default Chaos Daemon runs as a privileged Kubernetes DaemonSet, although that permission can be disabled. This is a consequential trade-off for security-conscious teams: access controls and namespace restrictions help govern use, but do not remove the need to assess the privileged component.

Compatibility depends on the release: Chaos Mesh 2.8 supports Kubernetes 1.30 through 1.35, while 2.7 supports 1.26 through 1.28. The official Helm repository supports Helm 3 and provides installation into a Kubernetes namespace. Security issues are fixed as soon as possible and back-ported to the last two releases.

Pricing

Chaos Mesh is free under the Apache License 2.0. Its free plan, Chaos Mesh, costs nothing and includes the open-source, cloud-native platform running on Kubernetes. There are no paid tiers described; teams take on the work of operating the self-hosted deployment, including maintaining dashboard persistence and managing Kubernetes access.

Platforms

Chaos Mesh is self-hosted and exposes a web dashboard and API. Kubernetes is required for its experiment management model. The official Helm installation supports Helm 3.

Who it's for

Chaos Mesh is a strong fit for platform, reliability, and application teams that already run Kubernetes and want recurring or coordinated fault experiments across development, testing, or production. Its scope controls and health checks help teams build disciplined exercises, while the breadth of fault types supports testing at multiple layers. It is less suitable for teams without Kubernetes operations capacity or those unwilling to run a privileged daemon by default.

Pros and cons

Pros

• Broad coverage across application, operating-system, cloud, and physical-machine faults gives Kubernetes teams varied failure modes to exercise.
• Scheduling, serial or parallel workflows, status checks, and target selectors support repeatable experiments with bounded scope.
• Free, Apache-licensed software can be installed in a Kubernetes namespace using Helm 3.
• Dashboard RBAC and namespace annotations provide controls for restricting experiment operations and locations.

Cons

• The default privileged Chaos Daemon raises a meaningful security consideration, even though its privileged permission can be disabled.
• Dashboard data stored in SQLite is lost after reboot without persistent volumes, so durability requires storage configuration.
• Kubernetes compatibility is release-specific, and RemoteCluster is still described as an early-stage feature.
• Pod Kill exercises need a ReplicaSet or similar mechanism if automatic Pod restart is required.

Alternatives

For a different free option, Krkn supports API, Linux, self-hosted, and web platforms; its plan has no stated pricing or usage limits.

Reliably is a freemium, open-source alternative that describes its approach as avoiding lock-in. Its free plan costs nothing and allows one team member.

Chaos Toolkit is another free, Apache-licensed open-source option, presented as a CLI rather than a Kubernetes-specific platform.

ChaosBlade may suit readers comparing a free tool with stated support for three system platforms, four programming-language applications, and more than 200 experiment scenarios.

LitmusChaos offers both a free hosted SaaS plan and a free open-source platform for installation on a cluster.

PowerfulSeal is a free, self-hosted Kubernetes chaos-testing option installed through pip or Docker.

AWS Fault Injection Service is a paid alternative with a price of $0.10, paid once, billed per action-minute, plus $0.10 per action-minute for each additional account; AWS GovCloud (US-East and US-West) costs $0.12.

Gremlin is a paid alternative with a 30-day free trial that requires no credit card and does not auto-convert.

Browse more options in Chaos Engineering Platforms.

Verdict

Choose Chaos Mesh if your team already operates Kubernetes and wants a free, extensible way to schedule, scope, and coordinate fault experiments through the Kubernetes API. Its main advantage is the combination of broad fault coverage and Kubernetes-native controls; its main reason to look elsewhere is the operational and security responsibility of a self-hosted deployment, especially the privileged daemon default.