diff --git a/api/config/extension_test.go b/api/config/extension_test.go
index a03c5ba5..4f3e0f08 100644
--- a/api/config/extension_test.go
+++ b/api/config/extension_test.go
@@ -10,10 +10,13 @@ import (
 )
 
 func TestConfigParsing(t *testing.T) {
+	t.Parallel()
+
+	is := require.New(t)
 	contextName := "test"
 	cfg := NewExtension("evilcorp")
 	objectCfg, err := cfg.ToObject()
-	require.NoError(t, err)
+	is.NoError(err)
 	for name, testCase := range map[string]struct {
 		kubeconfig    clientcmdapi.Config
 		errorExpected bool
@@ -44,17 +47,19 @@ func TestConfigParsing(t *testing.T) {
 	} {
 
 		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
+
 			content, err := clientcmd.Write(testCase.kubeconfig)
-			require.NoError(t, err)
+			is.NoError(err)
 
 			parsedCfg, err := readExtension(content, contextName)
 			if testCase.errorExpected {
-				require.Error(t, err)
+				is.Error(err)
 				return
-			} else {
-				require.NoError(t, err)
 			}
-			require.Equal(t, parsedCfg.Organization, cfg.Organization)
+			is.NoError(err)
+			is.Equal(parsedCfg.Organization, cfg.Organization)
 		})
 	}
 }
diff --git a/api/log/client_test.go b/api/log/client_test.go
index 537e78df..ab57d2c5 100644
--- a/api/log/client_test.go
+++ b/api/log/client_test.go
@@ -8,11 +8,14 @@ import (
 	"time"
 
 	"github.com/grafana/loki/v3/pkg/logcli/output"
-	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestClient(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	t.Parallel()
+
+	is := require.New(t)
+	ctx, cancel := context.WithTimeout(t.Context(), time.Second)
 	defer cancel()
 
 	expectedTime := time.Now()
@@ -24,19 +27,13 @@ func TestClient(t *testing.T) {
 	out, err := output.NewLogOutput(&buf, "default", &output.LogOutputOptions{
 		NoLabels: true, ColoredOutput: false, Timezone: time.Local,
 	})
-	if err != nil {
-		t.Fatal(err)
-	}
+	is.NoError(err)
 
-	if err := c.QueryRange(ctx, out, Query{Limit: 10}); err != nil {
-		t.Fatal(err)
-	}
+	is.NoError(c.QueryRange(ctx, out, Query{Limit: 10}))
 
-	assert.Equal(t, fmt.Sprintf("%s %s\n", expectedTime.Local().Format(time.RFC3339), expectedLine), buf.String())
+	is.Equal(fmt.Sprintf("%s %s\n", expectedTime.Local().Format(time.RFC3339), expectedLine), buf.String())
 	buf.Reset()
 
-	if err := c.TailQuery(ctx, 0, out, Query{QueryString: "{app=\"test\"}", Limit: 10}); err != nil {
-		t.Fatal(err)
-	}
-	assert.Equal(t, fmt.Sprintf("%s %s\n", expectedTime.Local().Format(time.RFC3339), expectedLine), buf.String())
+	is.NoError(c.TailQuery(ctx, 0, out, Query{QueryString: "{app=\"test\"}", Limit: 10}))
+	is.Equal(fmt.Sprintf("%s %s\n", expectedTime.Local().Format(time.RFC3339), expectedLine), buf.String())
 }
diff --git a/api/util/apps_test.go b/api/util/apps_test.go
index 869e35b3..33f48e5f 100644
--- a/api/util/apps_test.go
+++ b/api/util/apps_test.go
@@ -5,10 +5,13 @@ import (
 	"testing"
 
 	apps "github.com/ninech/apis/apps/v1alpha1"
-	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestEnvUpdate(t *testing.T) {
+	t.Parallel()
+
+	is := require.New(t)
 	old := apps.EnvVars{
 		{
 			Name:  "old3",
@@ -37,5 +40,5 @@ func TestEnvUpdate(t *testing.T) {
 		},
 	}
 
-	assert.True(t, reflect.DeepEqual(new, expected), "env vars should be updated: %+v \n %+v", new, expected)
+	is.True(reflect.DeepEqual(new, expected), "env vars should be updated: %+v \n %+v", new, expected)
 }
diff --git a/api/util/bucket_test.go b/api/util/bucket_test.go
index 424647fd..99564775 100644
--- a/api/util/bucket_test.go
+++ b/api/util/bucket_test.go
@@ -5,7 +5,6 @@ import (
 	"testing"
 
 	storage "github.com/ninech/apis/storage/v1alpha1"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -63,14 +62,17 @@ func TestParseSegments(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
+
 			got, err := parseSegmentsStrict(tt.chunks)
 			if tt.wantErr != "" {
-				assert.Error(t, err)
-				assert.Contains(t, err.Error(), tt.wantErr)
+				is.Error(err)
+				is.Contains(err.Error(), tt.wantErr)
 				return
 			}
-			assert.NoError(t, err)
-			assert.Equal(t, tt.wantPairs, got)
+			is.NoError(err)
+			is.Equal(tt.wantPairs, got)
 		})
 	}
 }
@@ -157,14 +159,17 @@ func TestParsePermissions(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
+
 			got, err := parsePermissions(tt.chunks, tt.allowEmptyUsers)
 			if tt.wantErr != "" {
-				assert.Error(t, err)
-				assert.Contains(t, err.Error(), tt.wantErr)
+				is.Error(err)
+				is.Contains(err.Error(), tt.wantErr)
 				return
 			}
-			assert.NoError(t, err)
-			assert.Equal(t, tt.want, got)
+			is.NoError(err)
+			is.Equal(tt.want, got)
 		})
 	}
 }
@@ -295,57 +300,74 @@ func TestParseCORSLooseWithMask(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
+
 			got, gotMask, err := parseCORSLooseWithMask(tt.chunks)
 
 			if tt.wantErr != "" {
-				assert.Error(t, err)
-				assert.Contains(t, strings.ToLower(err.Error()), strings.ToLower(tt.wantErr))
+				is.Error(err)
+				is.Contains(strings.ToLower(err.Error()), strings.ToLower(tt.wantErr))
 				return
 			}
-			assert.NoError(t, err)
-			assert.Equal(t, tt.wantMask, gotMask)
+			is.NoError(err)
+			is.Equal(tt.wantMask, gotMask)
 
 			if tt.nilFields.origins {
-				assert.Nil(t, got.Origins, "Origins should be nil")
+				is.Nil(got.Origins, "Origins should be nil")
 			} else {
-				assert.Equal(t, tt.want.Origins, got.Origins)
+				is.Equal(tt.want.Origins, got.Origins)
 			}
 			if tt.nilFields.responseHeaders {
-				assert.Nil(t, got.ResponseHeaders, "ResponseHeaders should be nil")
+				is.Nil(got.ResponseHeaders, "ResponseHeaders should be nil")
 			} else {
-				assert.Equal(t, tt.want.ResponseHeaders, got.ResponseHeaders)
+				is.Equal(tt.want.ResponseHeaders, got.ResponseHeaders)
 			}
 
-			assert.Equal(t, tt.want.MaxAge, got.MaxAge)
+			is.Equal(tt.want.MaxAge, got.MaxAge)
 		})
 	}
 }
 
 func TestParseKVPairsStrict(t *testing.T) {
+	t.Parallel()
+
 	t.Run("ok", func(t *testing.T) {
+		t.Parallel()
+		is := require.New(t)
+
 		kv, err := parseSegmentsStrict([]string{"a=1", " b = 2 ", "  "})
-		require.NoError(t, err)
-		require.Equal(t, []kvPair{
+		is.NoError(err)
+		is.Equal([]kvPair{
 			{key: "a", val: "1", segmentIndex: 1, raw: "a=1"},
 			{key: "b", val: "2", segmentIndex: 2, raw: " b = 2 "},
 		}, kv)
 	})
 	t.Run("error on missing equals", func(t *testing.T) {
+		t.Parallel()
+		is := require.New(t)
+
 		_, err := parseSegmentsStrict([]string{"a"})
-		require.Error(t, err)
-		require.Contains(t, err.Error(), `must be key=value`)
+		is.Error(err)
+		is.Contains(err.Error(), `must be key=value`)
 	})
 	t.Run("error on empty key", func(t *testing.T) {
+		t.Parallel()
+		is := require.New(t)
+
 		_, err := parseSegmentsStrict([]string{"=1"})
-		require.Error(t, err)
-		require.Contains(t, err.Error(), `empty key`)
+		is.Error(err)
+		is.Contains(err.Error(), `empty key`)
 	})
 }
 
 func TestParseKVPairsLoose(t *testing.T) {
+	t.Parallel()
+	is := require.New(t)
+
 	kv, err := parseSegmentsLoose([]string{"a", "b=", "c=3", "  "})
-	require.NoError(t, err)
-	require.Equal(t, []kvPair{
+	is.NoError(err)
+	is.Equal([]kvPair{
 		{key: "a", val: "", segmentIndex: 1, raw: "a"},
 		{key: "b", val: "", segmentIndex: 2, raw: "b="},
 		{key: "c", val: "3", segmentIndex: 3, raw: "c=3"},
@@ -353,8 +375,11 @@ func TestParseKVPairsLoose(t *testing.T) {
 }
 
 func TestParseKVMapLoose(t *testing.T) {
+	t.Parallel()
+	is := require.New(t)
+
 	m := parseKVMapLoose("prefix=logs/;is-live=true;note")
-	require.Equal(t, "logs/", m["prefix"])
-	require.Equal(t, "true", m["is-live"])
-	require.Equal(t, "", m["note"])
+	is.Equal("logs/", m["prefix"])
+	is.Equal("true", m["is-live"])
+	is.Equal("", m["note"])
 }
diff --git a/api/util/probe_test.go b/api/util/probe_test.go
index 0f3ad8da..e2db47e9 100644
--- a/api/util/probe_test.go
+++ b/api/util/probe_test.go
@@ -4,11 +4,13 @@ import (
 	"testing"
 
 	apps "github.com/ninech/apis/apps/v1alpha1"
-	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"k8s.io/utils/ptr"
 )
 
 func TestApplyProbePatch(t *testing.T) {
+	t.Parallel()
+
 	setPath := func(s string) OptString {
 		return OptString{State: Set, Val: s}
 	}
@@ -39,7 +41,8 @@ func TestApplyProbePatch(t *testing.T) {
 			cfg:  apps.Config{},
 			pp:   ProbePatch{Path: unsetPath(), PeriodSeconds: unsetPer()},
 			want: func(t *testing.T, got *apps.Config) {
-				assert.Nil(t, got.HealthProbe)
+				is := require.New(t)
+				is.Nil(got.HealthProbe)
 			},
 		},
 		{
@@ -47,10 +50,11 @@ func TestApplyProbePatch(t *testing.T) {
 			cfg:  apps.Config{},
 			pp:   ProbePatch{Path: setPath("/healthz"), PeriodSeconds: unsetPer()},
 			want: func(t *testing.T, got *apps.Config) {
-				if assert.NotNil(t, got.HealthProbe) && assert.NotNil(t, got.HealthProbe.HTTPGet) {
-					assert.Equal(t, "/healthz", got.HealthProbe.HTTPGet.Path)
-				}
-				assert.Nil(t, got.HealthProbe.PeriodSeconds)
+				is := require.New(t)
+				is.NotNil(got.HealthProbe)
+				is.NotNil(got.HealthProbe.HTTPGet)
+				is.Equal("/healthz", got.HealthProbe.HTTPGet.Path)
+				is.Nil(got.HealthProbe.PeriodSeconds)
 			},
 		},
 		{
@@ -58,12 +62,11 @@ func TestApplyProbePatch(t *testing.T) {
 			cfg:  apps.Config{},
 			pp:   ProbePatch{Path: unsetPath(), PeriodSeconds: setPer(7)},
 			want: func(t *testing.T, got *apps.Config) {
-				if assert.NotNil(t, got.HealthProbe) {
-					if assert.NotNil(t, got.HealthProbe.PeriodSeconds) {
-						assert.Equal(t, int32(7), *got.HealthProbe.PeriodSeconds)
-					}
-					assert.Nil(t, got.HealthProbe.HTTPGet)
-				}
+				is := require.New(t)
+				is.NotNil(got.HealthProbe)
+				is.NotNil(got.HealthProbe.PeriodSeconds)
+				is.Equal(int32(7), *got.HealthProbe.PeriodSeconds)
+				is.Nil(got.HealthProbe.HTTPGet)
 			},
 		},
 		{
@@ -78,12 +81,12 @@ func TestApplyProbePatch(t *testing.T) {
 			},
 			pp: ProbePatch{Path: setPath("/new"), PeriodSeconds: setPer(9)},
 			want: func(t *testing.T, got *apps.Config) {
-				if assert.NotNil(t, got.HealthProbe) && assert.NotNil(t, got.HealthProbe.HTTPGet) {
-					assert.Equal(t, "/new", got.HealthProbe.HTTPGet.Path)
-				}
-				if assert.NotNil(t, got.HealthProbe.PeriodSeconds) {
-					assert.Equal(t, int32(9), *got.HealthProbe.PeriodSeconds)
-				}
+				is := require.New(t)
+				is.NotNil(got.HealthProbe)
+				is.NotNil(got.HealthProbe.HTTPGet)
+				is.Equal("/new", got.HealthProbe.HTTPGet.Path)
+				is.NotNil(got.HealthProbe.PeriodSeconds)
+				is.Equal(int32(9), *got.HealthProbe.PeriodSeconds)
 			},
 		},
 		{
@@ -98,12 +101,11 @@ func TestApplyProbePatch(t *testing.T) {
 			},
 			pp: ProbePatch{Path: clearPath(), PeriodSeconds: unsetPer()},
 			want: func(t *testing.T, got *apps.Config) {
-				if assert.NotNil(t, got.HealthProbe) {
-					assert.Nil(t, got.HealthProbe.HTTPGet)
-					if assert.NotNil(t, got.HealthProbe.PeriodSeconds) {
-						assert.Equal(t, int32(5), *got.HealthProbe.PeriodSeconds)
-					}
-				}
+				is := require.New(t)
+				is.NotNil(got.HealthProbe)
+				is.Nil(got.HealthProbe.HTTPGet)
+				is.NotNil(got.HealthProbe.PeriodSeconds)
+				is.Equal(int32(5), *got.HealthProbe.PeriodSeconds)
 			},
 		},
 		{
@@ -118,11 +120,11 @@ func TestApplyProbePatch(t *testing.T) {
 			},
 			pp: ProbePatch{Path: unsetPath(), PeriodSeconds: clearPer()},
 			want: func(t *testing.T, got *apps.Config) {
-				if assert.NotNil(t, got.HealthProbe) {
-					assert.NotNil(t, got.HealthProbe.HTTPGet)
-					assert.Equal(t, "/ok", got.HealthProbe.HTTPGet.Path)
-					assert.Nil(t, got.HealthProbe.PeriodSeconds)
-				}
+				is := require.New(t)
+				is.NotNil(got.HealthProbe)
+				is.NotNil(got.HealthProbe.HTTPGet)
+				is.Equal("/ok", got.HealthProbe.HTTPGet.Path)
+				is.Nil(got.HealthProbe.PeriodSeconds)
 			},
 		},
 		{
@@ -135,7 +137,8 @@ func TestApplyProbePatch(t *testing.T) {
 			},
 			pp: ProbePatch{Path: clearPath(), PeriodSeconds: unsetPer()},
 			want: func(t *testing.T, got *apps.Config) {
-				assert.Nil(t, got.HealthProbe)
+				is := require.New(t)
+				is.Nil(got.HealthProbe)
 			},
 		},
 		{
@@ -145,13 +148,16 @@ func TestApplyProbePatch(t *testing.T) {
 			},
 			pp: ProbePatch{Path: unsetPath(), PeriodSeconds: unsetPer()},
 			want: func(t *testing.T, got *apps.Config) {
-				assert.Nil(t, got.HealthProbe)
+				is := require.New(t)
+				is.Nil(got.HealthProbe)
 			},
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			cfg := tt.cfg
 			ApplyProbePatch(&cfg, tt.pp)
 			tt.want(t, &cfg)
diff --git a/api/validation/git_information_client_test.go b/api/validation/git_information_client_test.go
index daf076b1..b6ceca71 100644
--- a/api/validation/git_information_client_test.go
+++ b/api/validation/git_information_client_test.go
@@ -1,7 +1,6 @@
 package validation_test
 
 import (
-	"context"
 	"net/http"
 	"testing"
 	"time"
@@ -10,20 +9,21 @@ import (
 	"github.com/ninech/nctl/api/util"
 	"github.com/ninech/nctl/api/validation"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/utils/ptr"
 )
 
 func TestRepositoryInformation(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
+
 	gitInfo := test.NewGitInformationService()
 	gitInfo.Start()
 	defer gitInfo.Close()
 
+	is := require.New(t)
 	dummyPrivateKey, err := test.GenerateRSAPrivateKey()
-	require.NoError(t, err)
+	is.NoError(err)
 
 	for name, testCase := range map[string]struct {
 		git              apps.GitTarget
@@ -74,7 +74,7 @@ func TestRepositoryInformation(t *testing.T) {
 			},
 			verifyRequest: func(t *testing.T) func(p test.GitInfoServiceParsed, err error) {
 				return func(p test.GitInfoServiceParsed, err error) {
-					is := assert.New(t)
+					is := require.New(t)
 					is.NoError(err)
 					is.Equal("https://github.com/ninech/deploio-examples", p.Request.Repository)
 					is.Equal("fake", p.Token)
@@ -106,12 +106,14 @@ func TestRepositoryInformation(t *testing.T) {
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
+			is := require.New(t)
+
 			if testCase.setResponse != nil {
 				gitInfo.SetResponse(*testCase.setResponse)
 			}
 
 			c, err := validation.NewGitInformationClient(gitInfo.URL(), testCase.token)
-			require.NoError(t, err)
+			is.NoError(err)
 
 			// we count the retries of the request
 			retries := 0
@@ -122,16 +124,16 @@ func TestRepositoryInformation(t *testing.T) {
 				c.SetRetryBackoffs(*testCase.backoff)
 			}
 
-			response, err := c.RepositoryInformation(ctx, testCase.git, testCase.auth)
+			response, err := c.RepositoryInformation(t.Context(), testCase.git, testCase.auth)
 			if testCase.errorExpected {
-				require.Error(t, err)
+				is.Error(err)
 			} else {
-				require.NoError(t, err)
+				is.NoError(err)
 			}
 
-			require.Equal(t, testCase.expectedRetries, retries)
+			is.Equal(testCase.expectedRetries, retries)
 			if testCase.expectedResponse != nil {
-				require.Equal(t, *testCase.expectedResponse, *response)
+				is.Equal(*testCase.expectedResponse, *response)
 			}
 			if testCase.verifyRequest != nil {
 				data, err := gitInfo.Request()
diff --git a/apply/file_test.go b/apply/file_test.go
index 61fd9251..f752c65e 100644
--- a/apply/file_test.go
+++ b/apply/file_test.go
@@ -1,7 +1,6 @@
 package apply
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"testing"
@@ -57,9 +56,9 @@ spec: {}
 )
 
 func TestFile(t *testing.T) {
-	ctx := context.Background()
-	apiClient, err := test.SetupClient()
-	require.NoError(t, err)
+	t.Parallel()
+
+	apiClient := test.SetupClient(t)
 	w := format.NewWriter(t.Output())
 
 	tests := map[string]struct {
@@ -111,27 +110,26 @@ func TestFile(t *testing.T) {
 
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
+			is := require.New(t)
+
 			f, err := os.CreateTemp("", "nctl-filetest*")
-			if err != nil {
-				t.Fatal(err)
-			}
+			is.NoError(err)
 			defer os.Remove(f.Name())
 
-			if _, err := fmt.Fprintf(f, tc.file, name, "value", runtimev1.DeletionOrphan); err != nil {
-				t.Fatal(err)
-			}
+			_, err = fmt.Fprintf(f, tc.file, name, "value", runtimev1.DeletionOrphan)
+			is.NoError(err)
 			// The file is written, but the pointer is at the end.
 			// Close it to flush content.
-			require.NoError(t, f.Close())
+			is.NoError(f.Close())
 
 			opts := []Option{}
 
 			// For delete and update tests, we first create the resource.
 			if tc.delete || tc.update {
 				fileToCreate, err := os.Open(f.Name())
-				require.NoError(t, err)
-				err = File(ctx, w, apiClient, fileToCreate) // This will close fileToCreate
-				require.NoError(t, err)
+				is.NoError(err)
+				err = File(t.Context(), w, apiClient, fileToCreate) // This will close fileToCreate
+				is.NoError(err)
 			}
 
 			if tc.delete {
@@ -141,18 +139,18 @@ func TestFile(t *testing.T) {
 			if tc.update {
 				// Re-create the file to truncate it and write the updated content.
 				updatedFile, err := os.Create(f.Name())
-				require.NoError(t, err)
+				is.NoError(err)
 				_, err = fmt.Fprintf(updatedFile, tc.file, name, tc.updatedAnnotation, tc.updatedSpecValue)
-				require.NoError(t, err)
-				require.NoError(t, updatedFile.Close())
+				is.NoError(err)
+				is.NoError(updatedFile.Close())
 
 				opts = append(opts, UpdateOnExists())
 			}
 
 			fileToApply, err := os.Open(f.Name())
-			require.NoError(t, err)
+			is.NoError(err)
 
-			if err := File(ctx, w, apiClient, fileToApply, opts...); err != nil {
+			if err := File(t.Context(), w, apiClient, fileToApply, opts...); err != nil {
 				if tc.expectedErr {
 					return
 				}
@@ -162,7 +160,7 @@ func TestFile(t *testing.T) {
 			}
 
 			asa := &iam.APIServiceAccount{}
-			if err := apiClient.Get(ctx, types.NamespacedName{Name: name, Namespace: "default"}, asa); err != nil {
+			if err := apiClient.Get(t.Context(), types.NamespacedName{Name: name, Namespace: "default"}, asa); err != nil {
 				if tc.delete {
 					if !errors.IsNotFound(err) {
 						t.Fatalf("expected resource to not exist after delete, got %s", err)
diff --git a/auth/cluster_test.go b/auth/cluster_test.go
index aa115592..0b7d3b1c 100644
--- a/auth/cluster_test.go
+++ b/auth/cluster_test.go
@@ -1,7 +1,6 @@
 package auth
 
 import (
-	"context"
 	"io"
 	"log"
 	"os"
@@ -10,7 +9,6 @@ import (
 	infrastructure "github.com/ninech/apis/infrastructure/v1alpha1"
 	"github.com/ninech/nctl/api/config"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/tools/clientcmd"
 )
@@ -31,6 +29,8 @@ contexts:
 `
 
 func TestClusterCmd(t *testing.T) {
+	t.Parallel()
+
 	// write our "existing" kubeconfig to a temp kubeconfig
 	kubeconfig, err := os.CreateTemp("", "*-kubeconfig.yaml")
 	if err != nil {
@@ -43,15 +43,14 @@ func TestClusterCmd(t *testing.T) {
 	}
 
 	cluster := newCluster()
-	apiClient, err := test.SetupClient(
+	apiClient := test.SetupClient(t,
 		test.WithObjects(cluster),
 	)
-	require.NoError(t, err)
 	apiClient.KubeconfigPath = kubeconfig.Name()
 
 	// we run without the execPlugin, that would be something for an e2e test
 	cmd := &ClusterCmd{Name: config.ContextName(cluster), ExecPlugin: false}
-	if err := cmd.Run(context.TODO(), apiClient); err != nil {
+	if err := cmd.Run(t.Context(), apiClient); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/auth/login_test.go b/auth/login_test.go
index eb73ab8b..282cff2d 100644
--- a/auth/login_test.go
+++ b/auth/login_test.go
@@ -15,7 +15,6 @@ import (
 	"github.com/ninech/nctl/api"
 	"github.com/ninech/nctl/api/config"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/oauth2"
 	"k8s.io/client-go/tools/clientcmd"
@@ -61,7 +60,7 @@ func TestLoginCmd(t *testing.T) {
 		ForceInteractiveEnvOverride: true,
 		tk:                          &fakeTokenGetter{},
 	}
-	if err := cmd.Run(context.Background()); err != nil {
+	if err := cmd.Run(t.Context()); err != nil {
 		t.Fatal(err)
 	}
 
@@ -139,7 +138,7 @@ func TestLoginClientCredentials(t *testing.T) {
 			defer os.Remove(kubeconfig.Name())
 			os.Setenv(clientcmd.RecommendedConfigPathEnvVar, kubeconfig.Name())
 
-			err = tt.cmd.Run(context.Background())
+			err = tt.cmd.Run(t.Context())
 			checkErrorRequire(t, err, tt.wantErr, tt.wantErrMessage)
 			if tt.wantErr {
 				return
@@ -157,11 +156,12 @@ func TestLoginClientCredentials(t *testing.T) {
 			if kc.AuthInfos[apiHost].Exec == nil {
 				t.Fatalf("expected kubeconfig to have execConfig")
 			}
+			is := require.New(t)
 			ext, err := config.ReadExtension(kubeconfig.Name(), apiHost)
-			assert.NoError(t, err)
-			assert.Equal(t, tt.expectedOrganization, ext.Organization)
-			assert.Equal(t, tt.expectedProject, kc.Contexts[apiHost].Namespace)
-			assert.Equal(t, kc.AuthInfos[apiHost].Exec.Args, []string{
+			is.NoError(err)
+			is.Equal(tt.expectedOrganization, ext.Organization)
+			is.Equal(tt.expectedProject, kc.Contexts[apiHost].Namespace)
+			is.Equal(kc.AuthInfos[apiHost].Exec.Args, []string{
 				CmdName,
 				ClientCredentialsCmdName,
 				api.ClientIDArg + tt.cmd.API.ClientID,
@@ -222,7 +222,6 @@ func TestLoginStaticToken(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
 			kubeconfig, err := os.CreateTemp("", "*-kubeconfig.yaml")
 			if err != nil {
 				log.Fatal(err)
@@ -230,7 +229,7 @@ func TestLoginStaticToken(t *testing.T) {
 			defer os.Remove(kubeconfig.Name())
 			os.Setenv(clientcmd.RecommendedConfigPathEnvVar, kubeconfig.Name())
 
-			err = tt.cmd.Run(context.Background())
+			err = tt.cmd.Run(t.Context())
 			checkErrorRequire(t, err, tt.wantErr, tt.wantErrMessage)
 
 			if tt.wantErr {
@@ -280,7 +279,7 @@ func TestLoginCmdWithoutExistingKubeconfig(t *testing.T) {
 		ForceInteractiveEnvOverride: true,
 		tk:                          &fakeTokenGetter{},
 	}
-	if err := cmd.Run(context.Background()); err != nil {
+	if err := cmd.Run(t.Context()); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/auth/set_project_test.go b/auth/set_project_test.go
index 3673bfdb..633787b5 100644
--- a/auth/set_project_test.go
+++ b/auth/set_project_test.go
@@ -59,10 +59,9 @@ func TestOrgFromProject(t *testing.T) {
 			t.Parallel()
 			is := require.New(t)
 
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithObjects(tc.objects...),
 			)
-			is.NoError(err)
 
 			org, err := orgFromProject(t.Context(), apiClient, tc.project)
 			if tc.wantErr {
@@ -111,12 +110,11 @@ func TestOrgFromProjectAPIErrors(t *testing.T) {
 			t.Parallel()
 			is := require.New(t)
 
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithInterceptorFuncs(tc.interceptor),
 			)
-			is.NoError(err)
 
-			_, err = orgFromProject(t.Context(), apiClient, "test-prod")
+			_, err := orgFromProject(t.Context(), apiClient, "test-prod")
 			is.Contains(strings.ToLower(err.Error()), strings.ToLower(tc.wantErrContain))
 		})
 	}
@@ -168,14 +166,13 @@ func TestTrySwitchOrg(t *testing.T) {
 			t.Parallel()
 			is := require.New(t)
 
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithOrganization(tc.currentOrg),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 				test.WithObjects(tc.objects...),
 			)
-			is.NoError(err)
 
-			err = trySwitchOrg(t.Context(), apiClient, tc.project)
+			err := trySwitchOrg(t.Context(), apiClient, tc.project)
 			if tc.wantErr {
 				is.Error(err)
 				return
@@ -215,15 +212,14 @@ func TestSetProjectCmd(t *testing.T) {
 			t.Parallel()
 			is := require.New(t)
 
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithOrganization(tc.currentOrg),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 				test.WithObjects(tc.objects...),
 			)
-			is.NoError(err)
 
 			cmd := SetProjectCmd{Name: tc.project}
-			err = cmd.Run(t.Context(), apiClient)
+			err := cmd.Run(t.Context(), apiClient)
 			if tc.wantErr {
 				is.Error(err)
 				return
diff --git a/auth/whoami_test.go b/auth/whoami_test.go
index 8486a4ee..39209f93 100644
--- a/auth/whoami_test.go
+++ b/auth/whoami_test.go
@@ -3,7 +3,6 @@
 package auth_test
 
 import (
-	"context"
 	"testing"
 
 	"github.com/ninech/nctl/auth"
@@ -12,20 +11,17 @@ import (
 )
 
 func TestWhoAmICmd_Run(t *testing.T) {
-	apiClient, err := test.SetupClient(
-		test.WithKubeconfig(t),
+	t.Parallel()
+
+	is := require.New(t)
+	apiClient := test.SetupClient(t,
+		test.WithKubeconfig(),
 	)
-	require.NoError(t, err)
 
 	s := &auth.WhoAmICmd{
 		IssuerURL: "https://auth.nine.ch/auth/realms/pub",
 		ClientID:  "nineapis.ch-f178254",
 	}
 
-	err = s.Run(context.Background(), apiClient)
-	if err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	require.NoError(t, err)
+	is.NoError(s.Run(t.Context(), apiClient))
 }
diff --git a/copy/application_test.go b/copy/application_test.go
index c2a17552..06027a6e 100644
--- a/copy/application_test.go
+++ b/copy/application_test.go
@@ -1,7 +1,6 @@
 package copy
 
 import (
-	"context"
 	"testing"
 
 	apps "github.com/ninech/apis/apps/v1alpha1"
@@ -9,7 +8,6 @@ import (
 	networking "github.com/ninech/apis/networking/v1alpha1"
 	"github.com/ninech/nctl/api/util"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -18,7 +16,7 @@ import (
 )
 
 func TestApplication(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
 	tests := map[string]struct {
 		source              *apps.Application
@@ -162,6 +160,9 @@ func TestApplication(t *testing.T) {
 
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
+
 			objs := []client.Object{tc.source}
 			if tc.sourceGitAuthSecret != nil {
 				objs = append(objs, tc.sourceGitAuthSecret)
@@ -169,39 +170,38 @@ func TestApplication(t *testing.T) {
 			if tc.staticEgress != nil {
 				objs = append(objs, tc.staticEgress)
 			}
-			apiClient, err := test.SetupClient(test.WithObjects(objs...))
-			require.NoError(t, err)
+			apiClient := test.SetupClient(t, test.WithObjects(objs...))
 
-			err = tc.cmd.Run(ctx, apiClient)
+			err := tc.cmd.Run(t.Context(), apiClient)
 			if tc.expectedErr != "" {
-				assert.ErrorContains(t, err, tc.expectedErr)
+				is.ErrorContains(err, tc.expectedErr)
 				return
 			}
-			require.NoError(t, err)
+			is.NoError(err)
 
 			copiedApp := &apps.Application{}
 			newName := types.NamespacedName{Name: tc.cmd.TargetName, Namespace: tc.cmd.targetNamespace(apiClient)}
-			assert.NoError(t, apiClient.Get(ctx, newName, copiedApp))
+			is.NoError(apiClient.Get(t.Context(), newName, copiedApp))
 			// expect copied app to be paused and hosts to be empty
 			tc.source.Spec.ForProvider.Paused = !tc.cmd.Start
 			if !tc.cmd.CopyHosts {
 				tc.source.Spec.ForProvider.Hosts = nil
 			}
-			assert.Equal(t, tc.source.Spec, copiedApp.Spec)
+			is.Equal(tc.source.Spec, copiedApp.Spec)
 
 			// check if git auth has been copied if there's a source
 			if tc.sourceGitAuthSecret != nil {
 				copiedSecret := &corev1.Secret{}
 				newSecretName := types.NamespacedName{Name: util.GitAuthSecretName(copiedApp), Namespace: tc.cmd.targetNamespace(apiClient)}
-				assert.NoError(t, apiClient.Get(ctx, newSecretName, copiedSecret))
-				assert.Equal(t, tc.sourceGitAuthSecret.Data, copiedSecret.Data)
+				is.NoError(apiClient.Get(t.Context(), newSecretName, copiedSecret))
+				is.Equal(tc.sourceGitAuthSecret.Data, copiedSecret.Data)
 			}
 			// check if static egress has been copied if there's a source
 			if tc.staticEgress != nil {
 				copiedEgress := &networking.StaticEgress{}
 				newEgressName := types.NamespacedName{Name: copiedApp.Name, Namespace: tc.cmd.targetNamespace(apiClient)}
-				assert.NoError(t, apiClient.Get(ctx, newEgressName, copiedEgress))
-				assert.Equal(t, tc.cmd.TargetName, copiedEgress.Spec.ForProvider.Target.Name)
+				is.NoError(apiClient.Get(t.Context(), newEgressName, copiedEgress))
+				is.Equal(tc.cmd.TargetName, copiedEgress.Spec.ForProvider.Target.Name)
 			}
 		})
 	}
diff --git a/create/apiserviceaccount_test.go b/create/apiserviceaccount_test.go
index aca6e6de..faf60081 100644
--- a/create/apiserviceaccount_test.go
+++ b/create/apiserviceaccount_test.go
@@ -6,13 +6,13 @@ import (
 	iam "github.com/ninech/apis/iam/v1alpha1"
 	"github.com/ninech/nctl/api"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestAPIServiceAccount(t *testing.T) {
-	apiClient, err := test.SetupClient()
-	require.NoError(t, err)
+	t.Parallel()
+
+	apiClient := test.SetupClient(t)
 
 	for name, tc := range map[string]struct {
 		cmd                    apiServiceAccountCmd
@@ -23,7 +23,8 @@ func TestAPIServiceAccount(t *testing.T) {
 				resourceCmd: resourceCmd{Name: "no-org-access"},
 			},
 			checkAPIServiceAccount: func(t *testing.T, cmd apiServiceAccountCmd, asa *iam.APIServiceAccount) {
-				assert.Equal(t, false, asa.Spec.ForProvider.OrganizationAccess)
+				is := require.New(t)
+				is.Equal(false, asa.Spec.ForProvider.OrganizationAccess)
 			},
 		},
 		"org access": {
@@ -32,14 +33,12 @@ func TestAPIServiceAccount(t *testing.T) {
 				OrganizationAccess: true,
 			},
 			checkAPIServiceAccount: func(t *testing.T, cmd apiServiceAccountCmd, asa *iam.APIServiceAccount) {
-				assert.Equal(t, true, asa.Spec.ForProvider.OrganizationAccess)
+				is := require.New(t)
+				is.Equal(true, asa.Spec.ForProvider.OrganizationAccess)
 			},
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
-			if err != nil {
-				t.Fatal(err)
-			}
 			if err := tc.cmd.Run(t.Context(), apiClient); err != nil {
 				t.Fatal(err)
 			}
diff --git a/create/application_test.go b/create/application_test.go
index 659981f9..f1b9a26d 100644
--- a/create/application_test.go
+++ b/create/application_test.go
@@ -17,7 +17,6 @@ import (
 	"github.com/ninech/nctl/api/log"
 	"github.com/ninech/nctl/api/util"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	corev1 "k8s.io/api/core/v1"
@@ -39,12 +38,9 @@ func createTempKeyFile(content string) (string, error) {
 }
 
 func TestApplication(t *testing.T) {
-	apiClient, err := test.SetupClient()
-	if err != nil {
-		t.Fatal(err)
-	}
+	t.Parallel()
 
-	ctx := context.Background()
+	apiClient := test.SetupClient(t)
 
 	dummyRSAKey, err := test.GenerateRSAPrivateKey()
 	if err != nil {
@@ -99,24 +95,25 @@ func TestApplication(t *testing.T) {
 				SkipRepoAccessCheck: true,
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
-				assert.Equal(t, cmd.Name, app.Name)
-				assert.Equal(t, cmd.Git.URL, app.Spec.ForProvider.Git.URL)
-				assert.Equal(t, cmd.Git.SubPath, app.Spec.ForProvider.Git.SubPath)
-				assert.Equal(t, cmd.Git.Revision, app.Spec.ForProvider.Git.Revision)
-				assert.Equal(t, cmd.Hosts, app.Spec.ForProvider.Hosts)
-				assert.Equal(t, apps.ApplicationSize(*cmd.Size), app.Spec.ForProvider.Config.Size)
-				assert.Equal(t, *cmd.Port, *app.Spec.ForProvider.Config.Port)
-				assert.Equal(t, cmd.HealthProbe.PeriodSeconds, *app.Spec.ForProvider.Config.HealthProbe.PeriodSeconds)
-				assert.Equal(t, cmd.HealthProbe.Path, app.Spec.ForProvider.Config.HealthProbe.HTTPGet.Path)
-				assert.Equal(t, *cmd.Replicas, *app.Spec.ForProvider.Config.Replicas)
-				assert.Equal(t, *cmd.BasicAuth, *app.Spec.ForProvider.Config.EnableBasicAuth)
-				assert.Equal(t, util.EnvVarsFromMap(cmd.Env), app.Spec.ForProvider.Config.Env)
-				assert.Equal(t, util.EnvVarsFromMap(cmd.BuildEnv), app.Spec.ForProvider.BuildEnv)
-				assert.Equal(t, cmd.DeployJob.Command, app.Spec.ForProvider.Config.DeployJob.Command)
-				assert.Equal(t, cmd.DeployJob.Name, app.Spec.ForProvider.Config.DeployJob.Name)
-				assert.Equal(t, cmd.DeployJob.Timeout, app.Spec.ForProvider.Config.DeployJob.Timeout.Duration)
-				assert.Equal(t, cmd.DeployJob.Retries, *app.Spec.ForProvider.Config.DeployJob.Retries)
-				assert.Nil(t, app.Spec.ForProvider.Git.Auth)
+				is := require.New(t)
+				is.Equal(cmd.Name, app.Name)
+				is.Equal(cmd.Git.URL, app.Spec.ForProvider.Git.URL)
+				is.Equal(cmd.Git.SubPath, app.Spec.ForProvider.Git.SubPath)
+				is.Equal(cmd.Git.Revision, app.Spec.ForProvider.Git.Revision)
+				is.Equal(cmd.Hosts, app.Spec.ForProvider.Hosts)
+				is.Equal(apps.ApplicationSize(*cmd.Size), app.Spec.ForProvider.Config.Size)
+				is.Equal(*cmd.Port, *app.Spec.ForProvider.Config.Port)
+				is.Equal(cmd.HealthProbe.PeriodSeconds, *app.Spec.ForProvider.Config.HealthProbe.PeriodSeconds)
+				is.Equal(cmd.HealthProbe.Path, app.Spec.ForProvider.Config.HealthProbe.HTTPGet.Path)
+				is.Equal(*cmd.Replicas, *app.Spec.ForProvider.Config.Replicas)
+				is.Equal(*cmd.BasicAuth, *app.Spec.ForProvider.Config.EnableBasicAuth)
+				is.Equal(util.EnvVarsFromMap(cmd.Env), app.Spec.ForProvider.Config.Env)
+				is.Equal(util.EnvVarsFromMap(cmd.BuildEnv), app.Spec.ForProvider.BuildEnv)
+				is.Equal(cmd.DeployJob.Command, app.Spec.ForProvider.Config.DeployJob.Command)
+				is.Equal(cmd.DeployJob.Name, app.Spec.ForProvider.Config.DeployJob.Name)
+				is.Equal(cmd.DeployJob.Timeout, app.Spec.ForProvider.Config.DeployJob.Timeout.Duration)
+				is.Equal(cmd.DeployJob.Retries, *app.Spec.ForProvider.Config.DeployJob.Retries)
+				is.Nil(app.Spec.ForProvider.Git.Auth)
 			},
 		},
 		"with basic auth": {
@@ -130,9 +127,10 @@ func TestApplication(t *testing.T) {
 				SkipRepoAccessCheck: true,
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
-				assert.Equal(t, cmd.Name, app.Name)
-				assert.Equal(t, apps.ApplicationSize(*cmd.Size), app.Spec.ForProvider.Config.Size)
-				assert.Equal(t, *cmd.BasicAuth, *app.Spec.ForProvider.Config.EnableBasicAuth)
+				is := require.New(t)
+				is.Equal(cmd.Name, app.Name)
+				is.Equal(apps.ApplicationSize(*cmd.Size), app.Spec.ForProvider.Config.Size)
+				is.Equal(*cmd.BasicAuth, *app.Spec.ForProvider.Config.EnableBasicAuth)
 			},
 		},
 		"with user/pass git auth": {
@@ -149,15 +147,16 @@ func TestApplication(t *testing.T) {
 				SkipRepoAccessCheck: true,
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
+				is := require.New(t)
 				auth := util.GitAuth{Username: cmd.Git.Username, Password: cmd.Git.Password}
 				authSecret := auth.Secret(app)
-				if err := apiClient.Get(ctx, api.ObjectName(authSecret), authSecret); err != nil {
+				if err := apiClient.Get(t.Context(), api.ObjectName(authSecret), authSecret); err != nil {
 					t.Fatal(err)
 				}
 
-				assert.Equal(t, *cmd.Git.Username, string(authSecret.Data[util.UsernameSecretKey]))
-				assert.Equal(t, *cmd.Git.Password, string(authSecret.Data[util.PasswordSecretKey]))
-				assert.Equal(t, authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
+				is.Equal(*cmd.Git.Username, string(authSecret.Data[util.UsernameSecretKey]))
+				is.Equal(*cmd.Git.Password, string(authSecret.Data[util.PasswordSecretKey]))
+				is.Equal(authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
 			},
 		},
 		"with ssh key git auth": {
@@ -174,14 +173,15 @@ func TestApplication(t *testing.T) {
 				SkipRepoAccessCheck: true,
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
+				is := require.New(t)
 				auth := util.GitAuth{SSHPrivateKey: cmd.Git.SSHPrivateKey}
 				authSecret := auth.Secret(app)
-				if err := apiClient.Get(ctx, api.ObjectName(authSecret), authSecret); err != nil {
+				if err := apiClient.Get(t.Context(), api.ObjectName(authSecret), authSecret); err != nil {
 					t.Fatal(err)
 				}
 
-				assert.Equal(t, strings.TrimSpace(*cmd.Git.SSHPrivateKey), string(authSecret.Data[util.PrivateKeySecretKey]))
-				assert.Equal(t, authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
+				is.Equal(strings.TrimSpace(*cmd.Git.SSHPrivateKey), string(authSecret.Data[util.PrivateKeySecretKey]))
+				is.Equal(authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
 			},
 		},
 		"with ssh ed25519 key git auth": {
@@ -198,14 +198,15 @@ func TestApplication(t *testing.T) {
 				SkipRepoAccessCheck: true,
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
+				is := require.New(t)
 				auth := util.GitAuth{SSHPrivateKey: cmd.Git.SSHPrivateKey}
 				authSecret := auth.Secret(app)
-				if err := apiClient.Get(ctx, api.ObjectName(authSecret), authSecret); err != nil {
+				if err := apiClient.Get(t.Context(), api.ObjectName(authSecret), authSecret); err != nil {
 					t.Fatal(err)
 				}
 
-				assert.Equal(t, strings.TrimSpace(*cmd.Git.SSHPrivateKey), string(authSecret.Data[util.PrivateKeySecretKey]))
-				assert.Equal(t, authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
+				is.Equal(strings.TrimSpace(*cmd.Git.SSHPrivateKey), string(authSecret.Data[util.PrivateKeySecretKey]))
+				is.Equal(authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
 			},
 		},
 		"with ssh key git auth from file": {
@@ -222,14 +223,15 @@ func TestApplication(t *testing.T) {
 				SkipRepoAccessCheck: true,
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
+				is := require.New(t)
 				auth := util.GitAuth{SSHPrivateKey: ptr.To("notused")}
 				authSecret := auth.Secret(app)
-				if err := apiClient.Get(ctx, api.ObjectName(authSecret), authSecret); err != nil {
+				if err := apiClient.Get(t.Context(), api.ObjectName(authSecret), authSecret); err != nil {
 					t.Fatal(err)
 				}
 
-				assert.Equal(t, dummyRSAKey, string(authSecret.Data[util.PrivateKeySecretKey]))
-				assert.Equal(t, authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
+				is.Equal(dummyRSAKey, string(authSecret.Data[util.PrivateKeySecretKey]))
+				is.Equal(authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
 			},
 		},
 		"with ed25519 ssh key git auth from file": {
@@ -246,14 +248,15 @@ func TestApplication(t *testing.T) {
 				SkipRepoAccessCheck: true,
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
+				is := require.New(t)
 				auth := util.GitAuth{SSHPrivateKey: ptr.To("notused")}
 				authSecret := auth.Secret(app)
-				if err := apiClient.Get(ctx, api.ObjectName(authSecret), authSecret); err != nil {
+				if err := apiClient.Get(t.Context(), api.ObjectName(authSecret), authSecret); err != nil {
 					t.Fatal(err)
 				}
 
-				assert.Equal(t, strings.TrimSpace(dummyED25519Key), string(authSecret.Data[util.PrivateKeySecretKey]))
-				assert.Equal(t, authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
+				is.Equal(strings.TrimSpace(dummyED25519Key), string(authSecret.Data[util.PrivateKeySecretKey]))
+				is.Equal(authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
 			},
 		},
 		"with non valid ssh key": {
@@ -285,7 +288,8 @@ func TestApplication(t *testing.T) {
 				SkipRepoAccessCheck: true,
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
-				assert.Nil(t, app.Spec.ForProvider.Config.DeployJob)
+				is := require.New(t)
+				is.Nil(app.Spec.ForProvider.Config.DeployJob)
 			},
 		},
 		"deploy job empty name": {
@@ -302,7 +306,8 @@ func TestApplication(t *testing.T) {
 				SkipRepoAccessCheck: true,
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
-				assert.Nil(t, app.Spec.ForProvider.Config.DeployJob)
+				is := require.New(t)
+				is.Nil(app.Spec.ForProvider.Config.DeployJob)
 			},
 		},
 		"git-information-service happy path": {
@@ -333,12 +338,13 @@ func TestApplication(t *testing.T) {
 				},
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
-				assert.Equal(t, cmd.Name, app.Name)
-				assert.Equal(t, cmd.Git.URL, app.Spec.ForProvider.Git.URL)
-				assert.Equal(t, cmd.Git.SubPath, app.Spec.ForProvider.Git.SubPath)
-				assert.Equal(t, cmd.Git.Revision, app.Spec.ForProvider.Git.Revision)
-				assert.Equal(t, apps.ApplicationSize(*cmd.Size), app.Spec.ForProvider.Config.Size)
-				assert.Nil(t, app.Spec.ForProvider.Git.Auth)
+				is := require.New(t)
+				is.Equal(cmd.Name, app.Name)
+				is.Equal(cmd.Git.URL, app.Spec.ForProvider.Git.URL)
+				is.Equal(cmd.Git.SubPath, app.Spec.ForProvider.Git.SubPath)
+				is.Equal(cmd.Git.Revision, app.Spec.ForProvider.Git.Revision)
+				is.Equal(apps.ApplicationSize(*cmd.Size), app.Spec.ForProvider.Config.Size)
+				is.Nil(app.Spec.ForProvider.Git.Auth)
 			},
 		},
 		"git-information-service received errors": {
@@ -437,12 +443,13 @@ func TestApplication(t *testing.T) {
 				},
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
-				assert.Equal(t, cmd.Name, app.Name)
-				assert.Equal(t, "https://github.com/ninech/doesnotexist.git", app.Spec.ForProvider.Git.URL)
-				assert.Equal(t, cmd.Git.SubPath, app.Spec.ForProvider.Git.SubPath)
-				assert.Equal(t, cmd.Git.Revision, app.Spec.ForProvider.Git.Revision)
-				assert.Equal(t, apps.ApplicationSize(*cmd.Size), app.Spec.ForProvider.Config.Size)
-				assert.Nil(t, app.Spec.ForProvider.Git.Auth)
+				is := require.New(t)
+				is.Equal(cmd.Name, app.Name)
+				is.Equal("https://github.com/ninech/doesnotexist.git", app.Spec.ForProvider.Git.URL)
+				is.Equal(cmd.Git.SubPath, app.Spec.ForProvider.Git.SubPath)
+				is.Equal(cmd.Git.Revision, app.Spec.ForProvider.Git.Revision)
+				is.Equal(apps.ApplicationSize(*cmd.Size), app.Spec.ForProvider.Config.Size)
+				is.Nil(app.Spec.ForProvider.Git.Auth)
 			},
 		},
 		"with sensitive env": {
@@ -460,38 +467,41 @@ func TestApplication(t *testing.T) {
 				SkipRepoAccessCheck: true,
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
+				is := require.New(t)
 				env := util.EnvVarByName(app.Spec.ForProvider.Config.Env, "secret")
-				require.NotNil(t, env)
-				require.NotNil(t, env.Sensitive)
-				assert.True(t, *env.Sensitive)
-				assert.Equal(t, "orange", env.Value)
+				is.NotNil(env)
+				is.NotNil(env.Sensitive)
+				is.True(*env.Sensitive)
+				is.Equal("orange", env.Value)
 
 				buildEnv := util.EnvVarByName(app.Spec.ForProvider.BuildEnv, "build_secret")
-				require.NotNil(t, buildEnv)
-				require.NotNil(t, buildEnv.Sensitive)
-				assert.True(t, *buildEnv.Sensitive)
-				assert.Equal(t, "banana", buildEnv.Value)
+				is.NotNil(buildEnv)
+				is.NotNil(buildEnv.Sensitive)
+				is.True(*buildEnv.Sensitive)
+				is.Equal("banana", buildEnv.Value)
 			},
 		},
 	}
 
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
+			is := require.New(t)
+
 			if tc.cmd.GitInformationServiceURL == "" {
 				tc.cmd.GitInformationServiceURL = gitInfoService.URL()
 			}
 			gitInfoService.SetResponse(tc.gitInformationServiceResponse)
 			app := tc.cmd.newApplication("default")
 
-			err := tc.cmd.Run(ctx, apiClient)
+			err := tc.cmd.Run(t.Context(), apiClient)
 			if tc.errorExpected {
-				require.Error(t, err)
+				is.Error(err)
 				return
 			} else {
-				require.NoError(t, err)
+				is.NoError(err)
 			}
 
-			require.NoError(t, apiClient.Get(ctx, api.ObjectName(app), app))
+			is.NoError(apiClient.Get(t.Context(), api.ObjectName(app), app))
 
 			tc.checkApp(t, tc.cmd, app)
 		})
@@ -499,6 +509,8 @@ func TestApplication(t *testing.T) {
 }
 
 func TestApplicationWait(t *testing.T) {
+	t.Parallel()
+
 	cmd := applicationCmd{
 		resourceCmd: resourceCmd{
 			Wait:        true,
@@ -558,10 +570,7 @@ func TestApplicationWait(t *testing.T) {
 	release2 := *release
 	release2.Name = release2.Name + "-1"
 
-	apiClient, err := test.SetupClient(test.WithObjects(build, &build2, release, &release2, basicAuth))
-	if err != nil {
-		t.Fatal(err)
-	}
+	apiClient := test.SetupClient(t, test.WithObjects(build, &build2, release, &release2, basicAuth))
 
 	out, err := log.StdOut("default")
 	if err != nil {
@@ -570,7 +579,7 @@ func TestApplicationWait(t *testing.T) {
 
 	apiClient.Log = &log.Client{Client: log.NewFake(t, time.Now(), "one", "two"), StdOut: out}
 
-	ctx := context.Background()
+	ctx := t.Context()
 
 	// to test the wait we create a ticker that continuously updates our
 	// resources in a goroutine to simulate a controller doing the same
@@ -649,6 +658,9 @@ func TestApplicationWait(t *testing.T) {
 }
 
 func TestApplicationBuildFail(t *testing.T) {
+	t.Parallel()
+
+	is := require.New(t)
 	cmd := applicationCmd{
 		resourceCmd: resourceCmd{
 			Wait:        true,
@@ -669,10 +681,7 @@ func TestApplicationBuildFail(t *testing.T) {
 		},
 	}
 
-	client, err := test.SetupClient(test.WithObjects(build))
-	if err != nil {
-		t.Fatal(err)
-	}
+	client := test.SetupClient(t, test.WithObjects(build))
 
 	var buf bytes.Buffer
 	out, err := output.NewLogOutput(&buf, log.Mode("default"), &output.LogOutputOptions{
@@ -690,7 +699,7 @@ func TestApplicationBuildFail(t *testing.T) {
 	}
 	client.Log = &log.Client{Client: log.NewFake(t, time.Now(), buildLog...), StdOut: out}
 
-	ctx := context.Background()
+	ctx := t.Context()
 
 	// to test the wait we create a ticker that continuously updates our
 	// resources in a goroutine to simulate a controller doing the same
@@ -733,8 +742,8 @@ func TestApplicationBuildFail(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	assert.Contains(t, buf.String(), logString)
-	assert.Equal(t, test.CountLines(buf.String()), errorLogLines)
+	is.Contains(buf.String(), logString)
+	is.Equal(test.CountLines(buf.String()), errorLogLines)
 }
 
 func setResourceCondition(ctx context.Context, apiClient *api.Client, mg resource.Managed, condition runtimev1.Condition) error {
diff --git a/create/bucket_test.go b/create/bucket_test.go
index 98d12d81..cc495840 100644
--- a/create/bucket_test.go
+++ b/create/bucket_test.go
@@ -8,11 +8,12 @@ import (
 	storage "github.com/ninech/apis/storage/v1alpha1"
 	"github.com/ninech/nctl/api"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestBucket(t *testing.T) {
+	t.Parallel()
+
 	for name, tc := range map[string]struct {
 		flags           []string
 		wantForProvider *storage.BucketParameters
@@ -247,22 +248,25 @@ func TestBucket(t *testing.T) {
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
+
 			apiClient, resolvedName, err := runBucketCreateNamedWithFlags(t, "test-"+t.Name(), tc.flags)
 			if tc.wantErr {
-				require.Error(t, err)
+				is.Error(err)
 				return
 			}
-			require.NoError(t, err)
+			is.NoError(err)
 
 			created := &storage.Bucket{}
-			require.NoError(t, apiClient.Get(
+			is.NoError(apiClient.Get(
 				t.Context(),
 				api.NamespacedName(resolvedName, apiClient.Project),
 				created,
 			))
 
 			if tc.wantForProvider != nil {
-				assert.Equal(t, *tc.wantForProvider, created.Spec.ForProvider)
+				is.Equal(*tc.wantForProvider, created.Spec.ForProvider)
 			}
 		})
 	}
diff --git a/create/bucketuser_test.go b/create/bucketuser_test.go
index 9aca600d..15ba37e4 100644
--- a/create/bucketuser_test.go
+++ b/create/bucketuser_test.go
@@ -6,13 +6,13 @@ import (
 	storage "github.com/ninech/apis/storage/v1alpha1"
 	"github.com/ninech/nctl/api"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestBucketUser(t *testing.T) {
-	apiClient, err := test.SetupClient()
-	require.NoError(t, err)
+	t.Parallel()
+
+	apiClient := test.SetupClient(t)
 
 	for name, tc := range map[string]struct {
 		cmd             bucketUserCmd
@@ -24,14 +24,12 @@ func TestBucketUser(t *testing.T) {
 				Location:    "nine-es34",
 			},
 			checkBucketUser: func(t *testing.T, cmd bucketUserCmd, bu *storage.BucketUser) {
-				assert.Equal(t, "nine-es34", string(bu.Spec.ForProvider.Location))
+				is := require.New(t)
+				is.Equal("nine-es34", string(bu.Spec.ForProvider.Location))
 			},
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
-			if err != nil {
-				t.Fatal(err)
-			}
 			if err := tc.cmd.Run(t.Context(), apiClient); err != nil {
 				t.Fatal(err)
 			}
diff --git a/create/cloudvm_test.go b/create/cloudvm_test.go
index 40d13cf2..585d773f 100644
--- a/create/cloudvm_test.go
+++ b/create/cloudvm_test.go
@@ -1,7 +1,6 @@
 package create
 
 import (
-	"context"
 	"reflect"
 	"testing"
 	"time"
@@ -9,14 +8,13 @@ import (
 	infrastructure "github.com/ninech/apis/infrastructure/v1alpha1"
 	"github.com/ninech/nctl/api"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
 )
 
 func TestCloudVM(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
 	tests := []struct {
 		name    string
@@ -57,19 +55,20 @@ func TestCloudVM(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			tt.create.Name = "test-" + t.Name()
 			tt.create.Wait = false
 			tt.create.WaitTimeout = time.Second
 
-			apiClient, err := test.SetupClient()
-			require.NoError(t, err)
+			apiClient := test.SetupClient(t)
 
-			if err := tt.create.Run(ctx, apiClient); (err != nil) != tt.wantErr {
+			if err := tt.create.Run(t.Context(), apiClient); (err != nil) != tt.wantErr {
 				t.Errorf("cloudVMCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
 
 			created := &infrastructure.CloudVirtualMachine{ObjectMeta: metav1.ObjectMeta{Name: tt.create.Name, Namespace: apiClient.Project}}
-			if err := apiClient.Get(ctx, api.ObjectName(created), created); (err != nil) != tt.wantErr {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), created); (err != nil) != tt.wantErr {
 				t.Fatalf("expected cloudVM to exist, got: %s", err)
 			}
 			if tt.wantErr {
diff --git a/create/create_test.go b/create/create_test.go
index 0aee1432..126f07be 100644
--- a/create/create_test.go
+++ b/create/create_test.go
@@ -8,13 +8,14 @@ import (
 	runtimev1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
 	iam "github.com/ninech/apis/iam/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/watch"
 )
 
 func TestCreate(t *testing.T) {
+	t.Parallel()
+
 	asa := &iam.APIServiceAccount{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "test",
@@ -30,12 +31,11 @@ func TestCreate(t *testing.T) {
 		},
 	}
 
-	apiClient, err := test.SetupClient()
-	require.NoError(t, err)
+	apiClient := test.SetupClient(t)
 	cmd := &apiServiceAccountCmd{}
 	c := cmd.newCreator(apiClient, asa, "apiserviceaccount")
 
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	ctx, cancel := context.WithTimeout(t.Context(), time.Second*5)
 	defer cancel()
 
 	if err := c.createResource(ctx); err != nil {
diff --git a/create/keyvaluestore_test.go b/create/keyvaluestore_test.go
index 81137245..9c70e02a 100644
--- a/create/keyvaluestore_test.go
+++ b/create/keyvaluestore_test.go
@@ -1,7 +1,6 @@
 package create
 
 import (
-	"context"
 	"testing"
 	"time"
 
@@ -17,7 +16,8 @@ import (
 )
 
 func TestKeyValueStore(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
+
 	tests := []struct {
 		name    string
 		create  keyValueStoreCmd
@@ -103,26 +103,28 @@ func TestKeyValueStore(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
+
 			tt.create.Name = "test-" + t.Name()
 			tt.create.Wait = false
 			tt.create.WaitTimeout = time.Second
 
-			apiClient, err := test.SetupClient()
-			require.NoError(t, err)
+			apiClient := test.SetupClient(t)
 
-			if err := tt.create.Run(ctx, apiClient); (err != nil) != tt.wantErr {
+			if err := tt.create.Run(t.Context(), apiClient); (err != nil) != tt.wantErr {
 				t.Errorf("keyValueStoreCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
 
 			created := &storage.KeyValueStore{ObjectMeta: metav1.ObjectMeta{Name: tt.create.Name, Namespace: apiClient.Project}}
-			if err := apiClient.Get(ctx, api.ObjectName(created), created); (err != nil) != tt.wantErr {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), created); (err != nil) != tt.wantErr {
 				t.Fatalf("expected keyvaluestore to exist, got: %s", err)
 			}
 			if tt.wantErr {
 				return
 			}
 
-			require.True(t, cmp.Equal(tt.want, created.Spec.ForProvider))
+			is.True(cmp.Equal(tt.want, created.Spec.ForProvider))
 		})
 	}
 }
diff --git a/create/mysql_test.go b/create/mysql_test.go
index c7843306..1d6b22e7 100644
--- a/create/mysql_test.go
+++ b/create/mysql_test.go
@@ -19,7 +19,7 @@ import (
 )
 
 func TestMySQL(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
 	tests := []struct {
 		name             string
@@ -91,6 +91,9 @@ func TestMySQL(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
+
 			tt.create.Name = "test-" + t.Name()
 			tt.create.Wait = false
 			tt.create.WaitTimeout = time.Second
@@ -99,22 +102,21 @@ func TestMySQL(t *testing.T) {
 			if tt.interceptorFuncs != nil {
 				opts = append(opts, test.WithInterceptorFuncs(*tt.interceptorFuncs))
 			}
-			apiClient, err := test.SetupClient(opts...)
-			require.NoError(t, err)
+			apiClient := test.SetupClient(t, opts...)
 
-			if err := tt.create.Run(ctx, apiClient); (err != nil) != tt.wantErr {
+			if err := tt.create.Run(t.Context(), apiClient); (err != nil) != tt.wantErr {
 				t.Errorf("mySQLCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
 
 			created := &storage.MySQL{ObjectMeta: metav1.ObjectMeta{Name: tt.create.Name, Namespace: apiClient.Project}}
-			if err := apiClient.Get(ctx, api.ObjectName(created), created); (err != nil) != tt.wantErr {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), created); (err != nil) != tt.wantErr {
 				t.Fatalf("expected mysql to exist, got: %s", err)
 			}
 			if tt.wantErr {
 				return
 			}
 
-			require.True(t, cmp.Equal(tt.want, created.Spec.ForProvider))
+			is.True(cmp.Equal(tt.want, created.Spec.ForProvider))
 		})
 	}
 }
diff --git a/create/mysqldatabase_test.go b/create/mysqldatabase_test.go
index 84d146cf..50251ab2 100644
--- a/create/mysqldatabase_test.go
+++ b/create/mysqldatabase_test.go
@@ -17,7 +17,7 @@ import (
 )
 
 func TestMySQLDatabase(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
 	tests := []struct {
 		name             string
@@ -49,6 +49,9 @@ func TestMySQLDatabase(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
+
 			tt.create.Name = "test-" + t.Name()
 			tt.create.Wait = false
 			tt.create.WaitTimeout = time.Second
@@ -57,22 +60,21 @@ func TestMySQLDatabase(t *testing.T) {
 			if tt.interceptorFuncs != nil {
 				opts = append(opts, test.WithInterceptorFuncs(*tt.interceptorFuncs))
 			}
-			apiClient, err := test.SetupClient(opts...)
-			require.NoError(t, err)
+			apiClient := test.SetupClient(t, opts...)
 
-			if err := tt.create.Run(ctx, apiClient); (err != nil) != tt.wantErr {
+			if err := tt.create.Run(t.Context(), apiClient); (err != nil) != tt.wantErr {
 				t.Errorf("mysqlDatabaseCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
 
 			created := &storage.MySQLDatabase{ObjectMeta: metav1.ObjectMeta{Name: tt.create.Name, Namespace: apiClient.Project}}
-			if err := apiClient.Get(ctx, api.ObjectName(created), created); (err != nil) != tt.wantErr {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), created); (err != nil) != tt.wantErr {
 				t.Fatalf("expected mysqldatabase to exist, got: %s", err)
 			}
 			if tt.wantErr {
 				return
 			}
 
-			require.True(t, cmp.Equal(tt.want, created.Spec.ForProvider))
+			is.True(cmp.Equal(tt.want, created.Spec.ForProvider))
 		})
 	}
 }
diff --git a/create/opensearch_test.go b/create/opensearch_test.go
index 4e1c127b..5bf9b8d5 100644
--- a/create/opensearch_test.go
+++ b/create/opensearch_test.go
@@ -1,7 +1,6 @@
 package create
 
 import (
-	"context"
 	"testing"
 	"time"
 
@@ -17,7 +16,8 @@ import (
 )
 
 func TestOpenSearch(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
+
 	tests := []struct {
 		name    string
 		create  openSearchCmd
@@ -114,26 +114,28 @@ func TestOpenSearch(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
+
 			tt.create.Name = "test-" + t.Name()
 			tt.create.Wait = false
 			tt.create.WaitTimeout = time.Second
 
-			apiClient, err := test.SetupClient()
-			require.NoError(t, err)
+			apiClient := test.SetupClient(t)
 
-			if err := tt.create.Run(ctx, apiClient); (err != nil) != tt.wantErr {
+			if err := tt.create.Run(t.Context(), apiClient); (err != nil) != tt.wantErr {
 				t.Errorf("openSearchCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
 
 			created := &storage.OpenSearch{ObjectMeta: metav1.ObjectMeta{Name: tt.create.Name, Namespace: apiClient.Project}}
-			if err := apiClient.Get(ctx, api.ObjectName(created), created); (err != nil) != tt.wantErr {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), created); (err != nil) != tt.wantErr {
 				t.Fatalf("expected opensearch to exist, got: %s", err)
 			}
 			if tt.wantErr {
 				return
 			}
 
-			require.True(t, cmp.Equal(tt.want, created.Spec.ForProvider))
+			is.True(cmp.Equal(tt.want, created.Spec.ForProvider))
 		})
 	}
 }
diff --git a/create/postgres_test.go b/create/postgres_test.go
index a22bab62..89b81014 100644
--- a/create/postgres_test.go
+++ b/create/postgres_test.go
@@ -19,7 +19,7 @@ import (
 )
 
 func TestPostgres(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
 	tests := []struct {
 		name             string
@@ -71,6 +71,9 @@ func TestPostgres(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
+
 			tt.create.Name = "test-" + t.Name()
 			tt.create.Wait = false
 			tt.create.WaitTimeout = time.Second
@@ -79,22 +82,21 @@ func TestPostgres(t *testing.T) {
 			if tt.interceptorFuncs != nil {
 				opts = append(opts, test.WithInterceptorFuncs(*tt.interceptorFuncs))
 			}
-			apiClient, err := test.SetupClient(opts...)
-			require.NoError(t, err)
+			apiClient := test.SetupClient(t, opts...)
 
-			if err := tt.create.Run(ctx, apiClient); (err != nil) != tt.wantErr {
+			if err := tt.create.Run(t.Context(), apiClient); (err != nil) != tt.wantErr {
 				t.Errorf("postgresCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
 
 			created := &storage.Postgres{ObjectMeta: metav1.ObjectMeta{Name: tt.create.Name, Namespace: apiClient.Project}}
-			if err := apiClient.Get(ctx, api.ObjectName(created), created); (err != nil) != tt.wantErr {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), created); (err != nil) != tt.wantErr {
 				t.Fatalf("expected postgres to exist, got: %s", err)
 			}
 			if tt.wantErr {
 				return
 			}
 
-			require.True(t, cmp.Equal(tt.want, created.Spec.ForProvider))
+			is.True(cmp.Equal(tt.want, created.Spec.ForProvider))
 		})
 	}
 }
diff --git a/create/postgresdatabase_test.go b/create/postgresdatabase_test.go
index 55791038..84a27436 100644
--- a/create/postgresdatabase_test.go
+++ b/create/postgresdatabase_test.go
@@ -17,7 +17,7 @@ import (
 )
 
 func TestPostgresDatabase(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
 	tests := []struct {
 		name             string
@@ -49,6 +49,9 @@ func TestPostgresDatabase(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
+
 			tt.create.Name = "test-" + t.Name()
 			tt.create.Wait = false
 			tt.create.WaitTimeout = time.Second
@@ -57,22 +60,21 @@ func TestPostgresDatabase(t *testing.T) {
 			if tt.interceptorFuncs != nil {
 				opts = append(opts, test.WithInterceptorFuncs(*tt.interceptorFuncs))
 			}
-			apiClient, err := test.SetupClient(opts...)
-			require.NoError(t, err)
+			apiClient := test.SetupClient(t, opts...)
 
-			if err := tt.create.Run(ctx, apiClient); (err != nil) != tt.wantErr {
+			if err := tt.create.Run(t.Context(), apiClient); (err != nil) != tt.wantErr {
 				t.Errorf("postgresDatabaseCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
 
 			created := &storage.PostgresDatabase{ObjectMeta: metav1.ObjectMeta{Name: tt.create.Name, Namespace: apiClient.Project}}
-			if err := apiClient.Get(ctx, api.ObjectName(created), created); (err != nil) != tt.wantErr {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), created); (err != nil) != tt.wantErr {
 				t.Fatalf("expected postgresdatabase to exist, got: %s", err)
 			}
 			if tt.wantErr {
 				return
 			}
 
-			require.True(t, cmp.Equal(tt.want, created.Spec.ForProvider))
+			is.True(cmp.Equal(tt.want, created.Spec.ForProvider))
 		})
 	}
 }
diff --git a/create/project_config_test.go b/create/project_config_test.go
index 4f7ec665..daf09650 100644
--- a/create/project_config_test.go
+++ b/create/project_config_test.go
@@ -1,7 +1,6 @@
 package create
 
 import (
-	"context"
 	"testing"
 	"time"
 
@@ -9,17 +8,14 @@ import (
 	"github.com/ninech/nctl/api"
 	"github.com/ninech/nctl/api/util"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"k8s.io/utils/ptr"
 )
 
 func TestProjectConfig(t *testing.T) {
-	apiClient, err := test.SetupClient()
-	if err != nil {
-		t.Fatal(err)
-	}
+	t.Parallel()
 
-	ctx := context.Background()
+	apiClient := test.SetupClient(t)
 
 	cases := map[string]struct {
 		cmd         configCmd
@@ -40,16 +36,17 @@ func TestProjectConfig(t *testing.T) {
 			},
 			project: "namespace-1",
 			checkConfig: func(t *testing.T, cmd configCmd, cfg *apps.ProjectConfig) {
-				assert.Equal(t, apiClient.Project, cfg.Name)
-				assert.Equal(t, apps.ApplicationSize(cmd.Size), cfg.Spec.ForProvider.Config.Size)
-				assert.Equal(t, *cmd.Port, *cfg.Spec.ForProvider.Config.Port)
-				assert.Equal(t, *cmd.Replicas, *cfg.Spec.ForProvider.Config.Replicas)
-				assert.Equal(t, *cmd.BasicAuth, *cfg.Spec.ForProvider.Config.EnableBasicAuth)
-				assert.Equal(t, util.EnvVarsFromMap(*cmd.Env), cfg.Spec.ForProvider.Config.Env)
-				assert.Equal(t, cmd.DeployJob.Command, cfg.Spec.ForProvider.Config.DeployJob.Command)
-				assert.Equal(t, cmd.DeployJob.Name, cfg.Spec.ForProvider.Config.DeployJob.Name)
-				assert.Equal(t, cmd.DeployJob.Timeout, cfg.Spec.ForProvider.Config.DeployJob.Timeout.Duration)
-				assert.Equal(t, cmd.DeployJob.Retries, *cfg.Spec.ForProvider.Config.DeployJob.Retries)
+				is := require.New(t)
+				is.Equal(apiClient.Project, cfg.Name)
+				is.Equal(apps.ApplicationSize(cmd.Size), cfg.Spec.ForProvider.Config.Size)
+				is.Equal(*cmd.Port, *cfg.Spec.ForProvider.Config.Port)
+				is.Equal(*cmd.Replicas, *cfg.Spec.ForProvider.Config.Replicas)
+				is.Equal(*cmd.BasicAuth, *cfg.Spec.ForProvider.Config.EnableBasicAuth)
+				is.Equal(util.EnvVarsFromMap(*cmd.Env), cfg.Spec.ForProvider.Config.Env)
+				is.Equal(cmd.DeployJob.Command, cfg.Spec.ForProvider.Config.DeployJob.Command)
+				is.Equal(cmd.DeployJob.Name, cfg.Spec.ForProvider.Config.DeployJob.Name)
+				is.Equal(cmd.DeployJob.Timeout, cfg.Spec.ForProvider.Config.DeployJob.Timeout.Duration)
+				is.Equal(cmd.DeployJob.Retries, *cfg.Spec.ForProvider.Config.DeployJob.Retries)
 			},
 		},
 		"some fields not set": {
@@ -59,26 +56,28 @@ func TestProjectConfig(t *testing.T) {
 			},
 			project: "namespace-2",
 			checkConfig: func(t *testing.T, cmd configCmd, cfg *apps.ProjectConfig) {
-				assert.Equal(t, apiClient.Project, cfg.Name)
-				assert.Equal(t, apps.ApplicationSize(cmd.Size), cfg.Spec.ForProvider.Config.Size)
-				assert.Nil(t, cfg.Spec.ForProvider.Config.Port)
-				assert.Nil(t, cfg.Spec.ForProvider.Config.EnableBasicAuth)
-				assert.Equal(t, *cmd.Replicas, *cfg.Spec.ForProvider.Config.Replicas)
-				assert.Empty(t, cfg.Spec.ForProvider.Config.Env)
-				assert.Nil(t, cfg.Spec.ForProvider.Config.DeployJob)
+				is := require.New(t)
+				is.Equal(apiClient.Project, cfg.Name)
+				is.Equal(apps.ApplicationSize(cmd.Size), cfg.Spec.ForProvider.Config.Size)
+				is.Nil(cfg.Spec.ForProvider.Config.Port)
+				is.Nil(cfg.Spec.ForProvider.Config.EnableBasicAuth)
+				is.Equal(*cmd.Replicas, *cfg.Spec.ForProvider.Config.Replicas)
+				is.Empty(cfg.Spec.ForProvider.Config.Env)
+				is.Nil(cfg.Spec.ForProvider.Config.DeployJob)
 			},
 		},
 		"all fields not set": {
 			cmd:     configCmd{},
 			project: "namespace-3",
 			checkConfig: func(t *testing.T, cmd configCmd, cfg *apps.ProjectConfig) {
-				assert.Equal(t, apiClient.Project, cfg.Name)
-				assert.Equal(t, test.AppSizeNotSet, cfg.Spec.ForProvider.Config.Size)
-				assert.Nil(t, cfg.Spec.ForProvider.Config.Port)
-				assert.Nil(t, cfg.Spec.ForProvider.Config.Replicas)
-				assert.Empty(t, cfg.Spec.ForProvider.Config.Env)
-				assert.Nil(t, cfg.Spec.ForProvider.Config.EnableBasicAuth)
-				assert.Nil(t, cfg.Spec.ForProvider.Config.DeployJob)
+				is := require.New(t)
+				is.Equal(apiClient.Project, cfg.Name)
+				is.Equal(test.AppSizeNotSet, cfg.Spec.ForProvider.Config.Size)
+				is.Nil(cfg.Spec.ForProvider.Config.Port)
+				is.Nil(cfg.Spec.ForProvider.Config.Replicas)
+				is.Empty(cfg.Spec.ForProvider.Config.Env)
+				is.Nil(cfg.Spec.ForProvider.Config.EnableBasicAuth)
+				is.Nil(cfg.Spec.ForProvider.Config.DeployJob)
 			},
 		},
 	}
@@ -88,11 +87,11 @@ func TestProjectConfig(t *testing.T) {
 			apiClient.Project = tc.project
 			cfg := tc.cmd.newProjectConfig(tc.project)
 
-			if err := tc.cmd.Run(ctx, apiClient); err != nil {
+			if err := tc.cmd.Run(t.Context(), apiClient); err != nil {
 				t.Fatal(err)
 			}
 
-			if err := apiClient.Get(ctx, api.ObjectName(cfg), cfg); err != nil {
+			if err := apiClient.Get(t.Context(), api.ObjectName(cfg), cfg); err != nil {
 				t.Fatal(err)
 			}
 
diff --git a/create/project_test.go b/create/project_test.go
index 11baab7e..29c9e7bd 100644
--- a/create/project_test.go
+++ b/create/project_test.go
@@ -1,7 +1,6 @@
 package create
 
 import (
-	"context"
 	"os"
 	"testing"
 	"time"
@@ -14,17 +13,15 @@ import (
 )
 
 func TestProjects(t *testing.T) {
+	t.Parallel()
+
 	const existsAlready = "exists-already"
-	ctx := context.Background()
 	projectName, organization := "testproject", "evilcorp"
-	apiClient, err := test.SetupClient(
+	apiClient := test.SetupClient(t,
 		test.WithOrganization("evilcorp"),
-		test.WithKubeconfig(t),
+		test.WithKubeconfig(),
 		test.WithProjects(existsAlready),
 	)
-	if err != nil {
-		t.Fatal(err)
-	}
 
 	cmd := projectCmd{
 		resourceCmd: resourceCmd{
@@ -35,12 +32,12 @@ func TestProjects(t *testing.T) {
 		DisplayName: "Some Display Name",
 	}
 
-	if err := cmd.Run(ctx, apiClient); err != nil {
+	if err := cmd.Run(t.Context(), apiClient); err != nil {
 		t.Fatal(err)
 	}
 
 	if err := apiClient.Get(
-		ctx,
+		t.Context(),
 		api.NamespacedName(projectName, organization),
 		&management.Project{},
 	); err != nil {
@@ -49,17 +46,16 @@ func TestProjects(t *testing.T) {
 
 	// test if the command errors out if the project already exists
 	cmd.Name = existsAlready
-	if err := cmd.Run(ctx, apiClient); err == nil {
+	if err := cmd.Run(t.Context(), apiClient); err == nil {
 		t.Fatal("expected an error as project already exists, but got none")
 	}
 }
 
 func TestProjectsConfigErrors(t *testing.T) {
-	ctx := context.Background()
-	apiClient, err := test.SetupClient()
-	if err != nil {
-		t.Fatal(err)
-	}
+	t.Parallel()
+
+	is := require.New(t)
+	apiClient := test.SetupClient(t)
 	cmd := projectCmd{
 		resourceCmd: resourceCmd{
 			Name:        "testproject",
@@ -68,12 +64,12 @@ func TestProjectsConfigErrors(t *testing.T) {
 		},
 	}
 	// there is no kubeconfig so we expect to fail
-	require.Error(t, cmd.Run(ctx, apiClient))
+	is.Error(cmd.Run(t.Context(), apiClient))
 
 	// we create a kubeconfig which does not contain a nctl config
 	// extension
 	kubeconfig, err := test.CreateTestKubeconfig(apiClient, "")
-	require.NoError(t, err)
+	is.NoError(err)
 	defer os.Remove(kubeconfig)
-	require.ErrorIs(t, cmd.Run(ctx, apiClient), config.ErrExtensionNotFound)
+	is.ErrorIs(cmd.Run(t.Context(), apiClient), config.ErrExtensionNotFound)
 }
diff --git a/create/serviceconnection_test.go b/create/serviceconnection_test.go
index 3b0a8c5c..60b94b88 100644
--- a/create/serviceconnection_test.go
+++ b/create/serviceconnection_test.go
@@ -1,7 +1,6 @@
 package create
 
 import (
-	"context"
 	"testing"
 	"time"
 
@@ -12,14 +11,14 @@ import (
 	storage "github.com/ninech/apis/storage/v1alpha1"
 	"github.com/ninech/nctl/api"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
 )
 
 func TestServiceConnection(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
+
 	tests := []struct {
 		name             string
 		create           serviceConnectionCmd
@@ -220,6 +219,7 @@ func TestServiceConnection(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
 			is := require.New(t)
 
 			tt.create.Name = "test-" + t.Name()
@@ -230,8 +230,7 @@ func TestServiceConnection(t *testing.T) {
 			if tt.interceptorFuncs != nil {
 				opts = append(opts, test.WithInterceptorFuncs(*tt.interceptorFuncs))
 			}
-			apiClient, err := test.SetupClient(opts...)
-			is.NoError(err)
+			apiClient := test.SetupClient(t, opts...)
 
 			if err := tt.create.Source.UnmarshalText([]byte(tt.source)); err != nil {
 				if tt.wantErr {
@@ -247,12 +246,12 @@ func TestServiceConnection(t *testing.T) {
 				t.Errorf("destination.UnmarshalText() error = %v, wantErr %v", err, tt.wantErr)
 			}
 
-			if err := tt.create.Run(ctx, apiClient); (err != nil) != tt.wantErr {
+			if err := tt.create.Run(t.Context(), apiClient); (err != nil) != tt.wantErr {
 				t.Errorf("serviceConnectionCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
 
 			created := &networking.ServiceConnection{ObjectMeta: metav1.ObjectMeta{Name: tt.create.Name, Namespace: apiClient.Project}}
-			if err := apiClient.Get(ctx, api.ObjectName(created), created); (err != nil) != tt.wantErr {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), created); (err != nil) != tt.wantErr {
 				t.Fatalf("expected serviceconnection to exist, got: %s", err)
 			}
 			if tt.wantErr {
@@ -265,7 +264,7 @@ func TestServiceConnection(t *testing.T) {
 }
 
 func TestLabelSelector_UnmarshalText(t *testing.T) {
-	is := assert.New(t)
+	t.Parallel()
 
 	tests := []struct {
 		name    string
@@ -279,6 +278,8 @@ func TestLabelSelector_UnmarshalText(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
+			is := require.New(t)
+
 			ls := &LabelSelector{}
 			err := ls.UnmarshalText([]byte(tt.arg))
 			if err == nil && !tt.wantErr {
@@ -292,7 +293,7 @@ func TestLabelSelector_UnmarshalText(t *testing.T) {
 }
 
 func TestTypedReference_UnmarshalText(t *testing.T) {
-	is := assert.New(t)
+	t.Parallel()
 
 	tests := []struct {
 		name    string
@@ -306,6 +307,8 @@ func TestTypedReference_UnmarshalText(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
+			is := require.New(t)
+
 			r := &TypedReference{}
 			err := r.UnmarshalText([]byte(tt.arg))
 			if err == nil && !tt.wantErr {
diff --git a/create/vcluster_test.go b/create/vcluster_test.go
index 36122bce..2d0e5590 100644
--- a/create/vcluster_test.go
+++ b/create/vcluster_test.go
@@ -1,17 +1,16 @@
 package create
 
 import (
-	"context"
 	"testing"
 	"time"
 
 	"github.com/ninech/nctl/api"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 )
 
 func TestVCluster(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
+
 	cmd := vclusterCmd{
 		resourceCmd: resourceCmd{
 			Name:        "falcon",
@@ -21,14 +20,13 @@ func TestVCluster(t *testing.T) {
 	}
 
 	cluster := cmd.newCluster(test.DefaultProject)
-	apiClient, err := test.SetupClient()
-	require.NoError(t, err)
+	apiClient := test.SetupClient(t)
 
-	if err := cmd.Run(ctx, apiClient); err != nil {
+	if err := cmd.Run(t.Context(), apiClient); err != nil {
 		t.Fatal(err)
 	}
 
-	if err := apiClient.Get(ctx, api.ObjectName(cluster), cluster); err != nil {
+	if err := apiClient.Get(t.Context(), api.ObjectName(cluster), cluster); err != nil {
 		t.Fatalf("expected vcluster to exist, got: %s", err)
 	}
 }
diff --git a/delete/apiserviceaccount_test.go b/delete/apiserviceaccount_test.go
index 504b6862..26635250 100644
--- a/delete/apiserviceaccount_test.go
+++ b/delete/apiserviceaccount_test.go
@@ -31,10 +31,7 @@ func TestAPIServiceAccount(t *testing.T) {
 			Namespace: test.DefaultProject,
 		},
 	}
-	apiClient, err := test.SetupClient(test.WithObjects(asa))
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
+	apiClient := test.SetupClient(t, test.WithObjects(asa))
 
 	ctx := t.Context()
 	if err := cmd.Run(ctx, apiClient); err != nil {
diff --git a/delete/application_test.go b/delete/application_test.go
index 4afe2d9b..c9d82223 100644
--- a/delete/application_test.go
+++ b/delete/application_test.go
@@ -154,17 +154,14 @@ func TestApplication(t *testing.T) {
 				},
 			}
 
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithDefaultProject(project),
 				test.WithProjectsFromResources(testCase.testObjects.clientObjects()...),
 				test.WithObjects(testCase.testObjects.clientObjects()...),
 			)
-			if err != nil {
-				t.Fatalf("failed to setup api client: %v", err)
-			}
 
 			ctx := t.Context()
-			err = cmd.Run(ctx, apiClient)
+			err := cmd.Run(ctx, apiClient)
 			if testCase.errorExpected {
 				if err == nil {
 					t.Fatal("expected error but got none")
diff --git a/delete/bucket_test.go b/delete/bucket_test.go
index b6c49556..736e3874 100644
--- a/delete/bucket_test.go
+++ b/delete/bucket_test.go
@@ -29,10 +29,7 @@ func TestBucket(t *testing.T) {
 	}
 
 	bu := bucket("test", test.DefaultProject, string(meta.LocationNineES34))
-	apiClient, err := test.SetupClient(test.WithObjects(bu))
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
+	apiClient := test.SetupClient(t, test.WithObjects(bu))
 
 	ctx := t.Context()
 	if err := apiClient.Get(ctx, api.ObjectName(bu), bu); err != nil {
@@ -41,7 +38,7 @@ func TestBucket(t *testing.T) {
 	if err := cmd.Run(ctx, apiClient); err != nil {
 		t.Fatalf("failed to run bucket delete command: %v", err)
 	}
-	err = apiClient.Get(ctx, api.ObjectName(bu), bu)
+	err := apiClient.Get(ctx, api.ObjectName(bu), bu)
 	if err == nil {
 		t.Fatal("expected bucket to be deleted, but it still exists")
 	}
diff --git a/delete/bucketuser_test.go b/delete/bucketuser_test.go
index 0ee7c30d..6aafc8d8 100644
--- a/delete/bucketuser_test.go
+++ b/delete/bucketuser_test.go
@@ -29,10 +29,7 @@ func TestBucketUser(t *testing.T) {
 	}
 
 	bu := bucketUser("test", test.DefaultProject, "nine-es34")
-	apiClient, err := test.SetupClient(test.WithObjects(bu))
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
+	apiClient := test.SetupClient(t, test.WithObjects(bu))
 
 	ctx := t.Context()
 	if err := apiClient.Get(ctx, api.ObjectName(bu), bu); err != nil {
@@ -41,7 +38,7 @@ func TestBucketUser(t *testing.T) {
 	if err := cmd.Run(ctx, apiClient); err != nil {
 		t.Fatalf("failed to run bucketuser delete command: %v", err)
 	}
-	err = apiClient.Get(ctx, api.ObjectName(bu), bu)
+	err := apiClient.Get(ctx, api.ObjectName(bu), bu)
 	if err == nil {
 		t.Fatal("expected bucketuser to be deleted, but it still exists")
 	}
diff --git a/delete/cloudvm_test.go b/delete/cloudvm_test.go
index 9b043ea9..581386b3 100644
--- a/delete/cloudvm_test.go
+++ b/delete/cloudvm_test.go
@@ -28,10 +28,7 @@ func TestCloudVM(t *testing.T) {
 
 	cloudvm := test.CloudVirtualMachine("test", test.DefaultProject, "nine-es34", v1alpha1.VirtualMachinePowerState("on"))
 
-	apiClient, err := test.SetupClient()
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
+	apiClient := test.SetupClient(t)
 
 	ctx := t.Context()
 	if err := apiClient.Create(ctx, cloudvm); err != nil {
@@ -43,7 +40,7 @@ func TestCloudVM(t *testing.T) {
 	if err := cmd.Run(ctx, apiClient); err != nil {
 		t.Fatalf("failed to run cloudvm delete command: %v", err)
 	}
-	err = apiClient.Get(ctx, api.ObjectName(cloudvm), cloudvm)
+	err := apiClient.Get(ctx, api.ObjectName(cloudvm), cloudvm)
 	if err == nil {
 		t.Fatal("expected cloudvm to be deleted, but it still exists")
 	}
diff --git a/delete/delete_test.go b/delete/delete_test.go
index 0ff98c9a..31ca6654 100644
--- a/delete/delete_test.go
+++ b/delete/delete_test.go
@@ -22,12 +22,9 @@ func TestDeleter(t *testing.T) {
 		},
 		Spec: iam.APIServiceAccountSpec{},
 	}
-	apiClient, err := test.SetupClient(
+	apiClient := test.SetupClient(t,
 		test.WithObjects(asa),
 	)
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
 	out := &bytes.Buffer{}
 	cmd := &apiServiceAccountCmd{resourceCmd{Writer: format.NewWriter(out)}}
 
diff --git a/delete/keyvaluestore_test.go b/delete/keyvaluestore_test.go
index 1e94d2dc..fa1514a1 100644
--- a/delete/keyvaluestore_test.go
+++ b/delete/keyvaluestore_test.go
@@ -27,10 +27,7 @@ func TestKeyValueStore(t *testing.T) {
 
 	keyValueStore := test.KeyValueStore("test", test.DefaultProject, "nine-es34")
 
-	apiClient, err := test.SetupClient()
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
+	apiClient := test.SetupClient(t)
 
 	ctx := t.Context()
 	if err := apiClient.Create(ctx, keyValueStore); err != nil {
@@ -42,7 +39,7 @@ func TestKeyValueStore(t *testing.T) {
 	if err := cmd.Run(ctx, apiClient); err != nil {
 		t.Fatalf("failed to run keyvaluestore delete command: %v", err)
 	}
-	err = apiClient.Get(ctx, api.ObjectName(keyValueStore), keyValueStore)
+	err := apiClient.Get(ctx, api.ObjectName(keyValueStore), keyValueStore)
 	if err == nil {
 		t.Fatal("expected keyvaluestore to be deleted, but it still exists")
 	}
diff --git a/delete/mysql_test.go b/delete/mysql_test.go
index 79155f54..118845bb 100644
--- a/delete/mysql_test.go
+++ b/delete/mysql_test.go
@@ -26,10 +26,7 @@ func TestMySQL(t *testing.T) {
 	}
 
 	mysql := test.MySQL("test", test.DefaultProject, "nine-es34")
-	apiClient, err := test.SetupClient()
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
+	apiClient := test.SetupClient(t)
 
 	ctx := t.Context()
 	if err := apiClient.Create(ctx, mysql); err != nil {
@@ -41,7 +38,7 @@ func TestMySQL(t *testing.T) {
 	if err := cmd.Run(ctx, apiClient); err != nil {
 		t.Fatalf("failed to run mysql delete command: %v", err)
 	}
-	err = apiClient.Get(ctx, api.ObjectName(mysql), mysql)
+	err := apiClient.Get(ctx, api.ObjectName(mysql), mysql)
 	if err == nil {
 		t.Fatal("expected mysql to be deleted, but it still exists")
 	}
diff --git a/delete/mysqldatabase_test.go b/delete/mysqldatabase_test.go
index 6663b4a8..2deb38d3 100644
--- a/delete/mysqldatabase_test.go
+++ b/delete/mysqldatabase_test.go
@@ -27,10 +27,7 @@ func TestMySQLDatabase(t *testing.T) {
 
 	mysqlDatabase := test.MySQLDatabase("test", test.DefaultProject, "nine-es34")
 
-	apiClient, err := test.SetupClient()
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
+	apiClient := test.SetupClient(t)
 
 	ctx := t.Context()
 	if err := apiClient.Create(ctx, mysqlDatabase); err != nil {
@@ -42,7 +39,7 @@ func TestMySQLDatabase(t *testing.T) {
 	if err := cmd.Run(ctx, apiClient); err != nil {
 		t.Fatalf("failed to run mysqldatabase delete command: %v", err)
 	}
-	err = apiClient.Get(ctx, api.ObjectName(mysqlDatabase), mysqlDatabase)
+	err := apiClient.Get(ctx, api.ObjectName(mysqlDatabase), mysqlDatabase)
 	if err == nil {
 		t.Fatal("expected mysqldatabase to be deleted, but it still exists")
 	}
diff --git a/delete/opensearch_test.go b/delete/opensearch_test.go
index cf6707a3..35596f34 100644
--- a/delete/opensearch_test.go
+++ b/delete/opensearch_test.go
@@ -27,10 +27,7 @@ func TestOpenSearch(t *testing.T) {
 
 	opensearch := test.OpenSearch("test", test.DefaultProject, "nine-es34")
 
-	apiClient, err := test.SetupClient()
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
+	apiClient := test.SetupClient(t)
 
 	ctx := t.Context()
 	if err := apiClient.Create(ctx, opensearch); err != nil {
@@ -42,7 +39,7 @@ func TestOpenSearch(t *testing.T) {
 	if err := cmd.Run(ctx, apiClient); err != nil {
 		t.Fatalf("failed to run opensearch delete command: %v", err)
 	}
-	err = apiClient.Get(ctx, api.ObjectName(opensearch), opensearch)
+	err := apiClient.Get(ctx, api.ObjectName(opensearch), opensearch)
 	if err == nil {
 		t.Fatal("expected opensearch to be deleted, but it still exists")
 	}
diff --git a/delete/postgres_test.go b/delete/postgres_test.go
index 4c8f2317..f7a93cd3 100644
--- a/delete/postgres_test.go
+++ b/delete/postgres_test.go
@@ -27,10 +27,7 @@ func TestPostgres(t *testing.T) {
 
 	postgres := test.Postgres("test", test.DefaultProject, "nine-es34")
 
-	apiClient, err := test.SetupClient()
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
+	apiClient := test.SetupClient(t)
 
 	ctx := t.Context()
 	if err := apiClient.Create(ctx, postgres); err != nil {
@@ -42,7 +39,7 @@ func TestPostgres(t *testing.T) {
 	if err := cmd.Run(ctx, apiClient); err != nil {
 		t.Fatalf("failed to run postgres delete command: %v", err)
 	}
-	err = apiClient.Get(ctx, api.ObjectName(postgres), postgres)
+	err := apiClient.Get(ctx, api.ObjectName(postgres), postgres)
 	if err == nil {
 		t.Fatal("expected postgres to be deleted, but it still exists")
 	}
diff --git a/delete/postgresdatabase_test.go b/delete/postgresdatabase_test.go
index 27b2220d..99d45db1 100644
--- a/delete/postgresdatabase_test.go
+++ b/delete/postgresdatabase_test.go
@@ -27,10 +27,7 @@ func TestPostgresDatabase(t *testing.T) {
 
 	postgresDatabase := test.PostgresDatabase("test", test.DefaultProject, "nine-es34")
 
-	apiClient, err := test.SetupClient()
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
+	apiClient := test.SetupClient(t)
 
 	ctx := t.Context()
 	if err := apiClient.Create(ctx, postgresDatabase); err != nil {
@@ -42,7 +39,7 @@ func TestPostgresDatabase(t *testing.T) {
 	if err := cmd.Run(ctx, apiClient); err != nil {
 		t.Fatalf("failed to run postgresdatabase delete command: %v", err)
 	}
-	err = apiClient.Get(ctx, api.ObjectName(postgresDatabase), postgresDatabase)
+	err := apiClient.Get(ctx, api.ObjectName(postgresDatabase), postgresDatabase)
 	if err == nil {
 		t.Fatal("expected postgresdatabase to be deleted, but it still exists")
 	}
diff --git a/delete/project_config_test.go b/delete/project_config_test.go
index 74f73db4..12554935 100644
--- a/delete/project_config_test.go
+++ b/delete/project_config_test.go
@@ -32,14 +32,11 @@ func TestProjectConfig(t *testing.T) {
 		Wait:   false,
 	}
 
-	apiClient, err := test.SetupClient(
+	apiClient := test.SetupClient(t,
 		test.WithProjects(project),
 		test.WithDefaultProject(project),
 		test.WithObjects(cfg),
 	)
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
 	ctx := t.Context()
 
 	if err := cmd.Run(ctx, apiClient); err != nil {
diff --git a/delete/project_test.go b/delete/project_test.go
index 927189a8..3a8e55db 100644
--- a/delete/project_test.go
+++ b/delete/project_test.go
@@ -50,17 +50,14 @@ func TestProject(t *testing.T) {
 				},
 			}
 
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithOrganization(organization),
 				test.WithProjects(testCase.projects...),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			if err != nil {
-				t.Fatalf("failed to setup api client: %v", err)
-			}
 
 			ctx := t.Context()
-			err = cmd.Run(ctx, apiClient)
+			err := cmd.Run(ctx, apiClient)
 			if testCase.errorExpected {
 				if err == nil {
 					t.Fatal("expected error but got none")
@@ -97,10 +94,7 @@ func TestProject(t *testing.T) {
 func TestProjectsConfigErrors(t *testing.T) {
 	t.Parallel()
 	ctx := t.Context()
-	apiClient, err := test.SetupClient()
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
+	apiClient := test.SetupClient(t)
 	cmd := projectCmd{
 		resourceCmd: resourceCmd{
 			Force: true,
diff --git a/delete/serviceconnection_test.go b/delete/serviceconnection_test.go
index f8196b91..08f67985 100644
--- a/delete/serviceconnection_test.go
+++ b/delete/serviceconnection_test.go
@@ -27,10 +27,7 @@ func TestServiceConnection(t *testing.T) {
 
 	sc := test.ServiceConnection("test", test.DefaultProject)
 
-	apiClient, err := test.SetupClient()
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
+	apiClient := test.SetupClient(t)
 
 	ctx := t.Context()
 	if err := apiClient.Create(ctx, sc); err != nil {
@@ -42,7 +39,7 @@ func TestServiceConnection(t *testing.T) {
 	if err := cmd.Run(ctx, apiClient); err != nil {
 		t.Fatalf("failed to run serviceconnection delete command: %v", err)
 	}
-	err = apiClient.Get(ctx, api.ObjectName(sc), sc)
+	err := apiClient.Get(ctx, api.ObjectName(sc), sc)
 	if err == nil {
 		t.Fatal("expected serviceconnection to be deleted, but it still exists")
 	}
diff --git a/delete/vcluster_test.go b/delete/vcluster_test.go
index b1509194..7947d1b8 100644
--- a/delete/vcluster_test.go
+++ b/delete/vcluster_test.go
@@ -38,10 +38,7 @@ func TestVCluster(t *testing.T) {
 		},
 	}
 
-	apiClient, err := test.SetupClient(test.WithObjects(cluster))
-	if err != nil {
-		t.Fatalf("failed to setup api client: %v", err)
-	}
+	apiClient := test.SetupClient(t, test.WithObjects(cluster))
 
 	kubeconfig, err := test.CreateTestKubeconfig(apiClient, "")
 	if err != nil {
diff --git a/edit/edit_test.go b/edit/edit_test.go
index 24ad93e6..1544884b 100644
--- a/edit/edit_test.go
+++ b/edit/edit_test.go
@@ -1,7 +1,6 @@
 package edit
 
 import (
-	"context"
 	"fmt"
 	"io"
 	"os"
@@ -12,7 +11,6 @@ import (
 	apps "github.com/ninech/apis/apps/v1alpha1"
 	networking "github.com/ninech/apis/networking/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -21,7 +19,6 @@ import (
 )
 
 func TestEdit(t *testing.T) {
-	ctx := context.Background()
 	// set cat as our "editor" for testing
 	for _, env := range editorEnvs {
 		t.Setenv(env, "cat")
@@ -59,12 +56,13 @@ func TestEdit(t *testing.T) {
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
+			is := require.New(t)
+
 			objs := []client.Object{tc.resource}
-			apiClient, err := test.SetupClient(test.WithObjects(objs...))
-			require.NoError(t, err)
+			apiClient := test.SetupClient(t, test.WithObjects(objs...))
 			r, w, _ := os.Pipe()
 			os.Stdout = w
-			err = tc.cmd.Run(&kong.Context{
+			err := tc.cmd.Run(&kong.Context{
 				Path: []*kong.Path{
 					{
 						Command: &kong.Command{
@@ -73,21 +71,21 @@ func TestEdit(t *testing.T) {
 						},
 					},
 				},
-			}, ctx, apiClient)
+			}, t.Context(), apiClient)
 			w.Close()
 			os.Stdout = originalStdOut
 			if tc.expectedErr != "" {
-				assert.ErrorContains(t, err, tc.expectedErr)
+				is.ErrorContains(err, tc.expectedErr)
 				return
 			}
-			require.NoError(t, err)
+			is.NoError(err)
 			out, err := io.ReadAll(r)
-			assert.NoError(t, err)
+			is.NoError(err)
 
 			gvk, err := apiutil.GVKForObject(tc.resource, apiClient.Scheme())
-			require.NoError(t, err)
+			is.NoError(err)
 			tc.resource.GetObjectKind().SetGroupVersionKind(gvk)
-			assert.True(t, strings.HasPrefix(string(out), fmt.Sprintf(header, formatObj(tc.resource))), "header matches")
+			is.True(strings.HasPrefix(string(out), fmt.Sprintf(header, formatObj(tc.resource))), "header matches")
 		})
 	}
 }
diff --git a/exec/application.go b/exec/application.go
index 39b60a31..3fea1522 100644
--- a/exec/application.go
+++ b/exec/application.go
@@ -53,7 +53,7 @@ type applicationCmd struct {
 }
 
 // Help displays examples for the application exec command
-func (ac applicationCmd) Help() string {
+func (cmd applicationCmd) Help() string {
 	return `Examples:
   # Open a shell in a buildpack/dockerfile built application. The dockerfile
   # built application needs a valid "/bin/sh" shell to be installed.
diff --git a/exec/application_test.go b/exec/application_test.go
index c6b3b422..319eb77d 100644
--- a/exec/application_test.go
+++ b/exec/application_test.go
@@ -1,7 +1,6 @@
 package exec
 
 import (
-	"context"
 	"fmt"
 	"testing"
 	"time"
@@ -21,10 +20,11 @@ const (
 )
 
 func TestApplicationReplicaSelection(t *testing.T) {
+	t.Parallel()
+
 	const (
 		firstApp, secondApp = "first-app", "second-app"
 	)
-	ctx := context.Background()
 
 	for name, testCase := range map[string]struct {
 		application string
@@ -275,24 +275,25 @@ func TestApplicationReplicaSelection(t *testing.T) {
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
-			apiClient, err := test.SetupClient(
-				test.WithKubeconfig(t),
+			t.Parallel()
+			is := require.New(t)
+
+			apiClient := test.SetupClient(t,
+				test.WithKubeconfig(),
 				test.WithNameIndexFor(&apps.Release{}),
 				test.WithObjects(addCreationTimestamp(testCase.releases)...),
 				test.WithDefaultProject(project),
 			)
-			require.NoError(t, err)
 
 			cmd := applicationCmd{resourceCmd: resourceCmd{Name: testCase.application}}
-			replica, buildType, err := cmd.getReplica(ctx, apiClient)
+			replica, buildType, err := cmd.getReplica(t.Context(), apiClient)
 			if testCase.expectError {
-				require.Error(t, err)
+				is.Error(err)
 				return
-			} else {
-				require.NoError(t, err)
 			}
-			require.Equal(t, testCase.expectedReplica, replica)
-			require.Equal(t, testCase.expectedBuildType, buildType)
+			is.NoError(err)
+			is.Equal(testCase.expectedReplica, replica)
+			is.Equal(testCase.expectedBuildType, buildType)
 		})
 	}
 }
diff --git a/get/all_test.go b/get/all_test.go
index 3eb53e4f..399123bb 100644
--- a/get/all_test.go
+++ b/get/all_test.go
@@ -2,7 +2,6 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"os"
 	"strings"
 	"testing"
@@ -13,7 +12,6 @@ import (
 	meta "github.com/ninech/apis/meta/v1alpha1"
 	"github.com/ninech/nctl/api"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -22,7 +20,6 @@ import (
 
 func TestAllContent(t *testing.T) {
 	t.Parallel()
-	ctx := context.Background()
 	organization := "evilcorp"
 
 	for name, testCase := range map[string]struct {
@@ -291,6 +288,8 @@ dev      pear    Release      apps.nine.ch
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
 			testCase := testCase
 
 			outputBuffer := &bytes.Buffer{}
@@ -311,7 +310,7 @@ dev      pear    Release      apps.nine.ch
 
 			apiClient := &api.Client{WithWatch: client, Project: testCase.projectName}
 			kubeconfig, err := test.CreateTestKubeconfig(apiClient, organization)
-			require.NoError(t, err)
+			is.NoError(err)
 			defer os.Remove(kubeconfig)
 
 			cmd := allCmd{
@@ -319,16 +318,16 @@ dev      pear    Release      apps.nine.ch
 				Kinds:                testCase.kinds,
 			}
 
-			err = cmd.Run(ctx, apiClient, get)
+			err = cmd.Run(t.Context(), apiClient, get)
 			if testCase.errorExpected {
-				require.Error(t, err)
+				is.Error(err)
 				for _, s := range testCase.errorContains {
-					assert.Contains(t, strings.ToLower(err.Error()), strings.ToLower(s))
+					is.Contains(strings.ToLower(err.Error()), strings.ToLower(s))
 				}
 				return
 			}
-			require.NoError(t, err)
-			assert.Equal(t, testCase.output, outputBuffer.String())
+			is.NoError(err)
+			is.Equal(testCase.output, outputBuffer.String())
 		})
 	}
 }
diff --git a/get/application_test.go b/get/application_test.go
index 3b22fbe9..d1376832 100644
--- a/get/application_test.go
+++ b/get/application_test.go
@@ -2,14 +2,12 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"testing"
 
 	apps "github.com/ninech/apis/apps/v1alpha1"
 	meta "github.com/ninech/apis/meta/v1alpha1"
 	"github.com/ninech/nctl/api/util"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -17,6 +15,9 @@ import (
 )
 
 func TestApplication(t *testing.T) {
+	t.Parallel()
+	is := require.New(t)
+
 	const otherProject = "my-pretty-other-project"
 	app := apps.Application{
 		ObjectMeta: metav1.ObjectMeta{
@@ -35,55 +36,52 @@ func TestApplication(t *testing.T) {
 	buf := &bytes.Buffer{}
 	get := NewTestCmd(buf, full)
 
-	apiClient, err := test.SetupClient(
+	apiClient := test.SetupClient(t,
 		test.WithNameIndexFor(&apps.Application{}),
 		test.WithProjectsFromResources(&app, &app2, &app3),
 		test.WithObjects(&app, &app2, &app3),
-		test.WithKubeconfig(t),
+		test.WithKubeconfig(),
 	)
-	require.NoError(t, err)
 
-	ctx := context.Background()
 	cmd := applicationsCmd{
 		BasicAuthCredentials: false,
 	}
 
-	if err := cmd.Run(ctx, apiClient, get); err != nil {
+	if err := cmd.Run(t.Context(), apiClient, get); err != nil {
 		t.Fatal(err)
 	}
 
-	assert.Equal(t, 3, test.CountLines(buf.String()), buf.String())
+	is.Equal(3, test.CountLines(buf.String()), buf.String())
 	buf.Reset()
 
 	cmd.Name = app.Name
-	if err := cmd.Run(ctx, apiClient, get); err != nil {
+	if err := cmd.Run(t.Context(), apiClient, get); err != nil {
 		t.Fatal(err)
 	}
 
-	assert.Equal(t, 2, test.CountLines(buf.String()))
+	is.Equal(2, test.CountLines(buf.String()))
 	buf.Reset()
 
 	get.Format = noHeader
-	if err := cmd.Run(ctx, apiClient, get); err != nil {
+	if err := cmd.Run(t.Context(), apiClient, get); err != nil {
 		t.Fatal(err)
 	}
 
-	assert.Equal(t, 1, test.CountLines(buf.String()))
+	is.Equal(1, test.CountLines(buf.String()))
 
 	// app3 is in a different project and we want to check if a hint gets
 	// displayed along the error that it was not found
 	cmd.Name = app3.Name
 	buf.Reset()
-	err = cmd.Run(ctx, apiClient, get)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), otherProject, err.Error())
+	err := cmd.Run(t.Context(), apiClient, get)
+	is.Error(err)
+	is.Contains(err.Error(), otherProject, err.Error())
 }
 
 func TestApplicationCredentials(t *testing.T) {
 	t.Parallel()
 
 	const basicAuthNotFound = "no application with basic auth enabled found\n"
-	ctx := context.Background()
 
 	for name, testCase := range map[string]struct {
 		resources     []client.Object
@@ -291,19 +289,20 @@ dev      dev-second  dev-second  sample-second
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
 			testCase := testCase
 			buf := &bytes.Buffer{}
 			get := NewTestCmd(buf, testCase.outputFormat)
 			get.AllProjects = testCase.project == ""
 
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(testCase.resources...),
 				test.WithObjects(testCase.resources...),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 				test.WithDefaultProject(testCase.project),
 				test.WithNameIndexFor(&apps.Application{}),
 			)
-			require.NoError(t, err)
 
 			cmd := applicationsCmd{
 				resourceCmd: resourceCmd{
@@ -312,13 +311,13 @@ dev      dev-second  dev-second  sample-second
 				BasicAuthCredentials: true,
 			}
 
-			err = cmd.Run(ctx, apiClient, get)
+			err := cmd.Run(t.Context(), apiClient, get)
 			if testCase.errorExpected {
-				require.Error(t, err)
+				is.Error(err)
 				return
 			}
-			require.NoError(t, err)
-			assert.Equal(t, testCase.output, buf.String())
+			is.NoError(err)
+			is.Equal(testCase.output, buf.String())
 		})
 	}
 }
@@ -326,8 +325,6 @@ dev      dev-second  dev-second  sample-second
 func TestApplicationDNS(t *testing.T) {
 	t.Parallel()
 
-	ctx := context.Background()
-
 	for name, testCase := range map[string]struct {
 		apps          []client.Object
 		name          string
@@ -463,17 +460,18 @@ Visit https://docs.nine.ch/a/myshbw3EY1 to see instructions on how to setup cust
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
 			testCase := testCase
 			buf := &bytes.Buffer{}
 			get := NewTestCmd(buf, testCase.outputFormat)
 			get.AllProjects = testCase.project == ""
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(testCase.apps...),
 				test.WithObjects(testCase.apps...),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 				test.WithDefaultProject(testCase.project),
 			)
-			require.NoError(t, err)
 
 			cmd := applicationsCmd{
 				resourceCmd: resourceCmd{
@@ -483,13 +481,13 @@ Visit https://docs.nine.ch/a/myshbw3EY1 to see instructions on how to setup cust
 				DNS:                  true,
 			}
 
-			err = cmd.Run(ctx, apiClient, get)
+			err := cmd.Run(t.Context(), apiClient, get)
 			if testCase.errorExpected {
-				require.Error(t, err)
+				is.Error(err)
 				return
 			}
-			require.NoError(t, err)
-			assert.Equal(t, testCase.output, buf.String())
+			is.NoError(err)
+			is.Equal(testCase.output, buf.String())
 		})
 	}
 }
diff --git a/get/bucket_test.go b/get/bucket_test.go
index 60b24692..147d2ba1 100644
--- a/get/bucket_test.go
+++ b/get/bucket_test.go
@@ -2,7 +2,6 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"strings"
 	"testing"
 	"time"
@@ -10,13 +9,14 @@ import (
 	meta "github.com/ninech/apis/meta/v1alpha1"
 	storage "github.com/ninech/apis/storage/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 func TestBucketGet(t *testing.T) {
+	t.Parallel()
+
 	type bucketInstance struct {
 		name     string
 		project  string
@@ -25,8 +25,6 @@ func TestBucketGet(t *testing.T) {
 		status   func(*storage.BucketStatus)
 	}
 
-	ctx := context.Background()
-
 	tests := []struct {
 		name          string
 		instances     []bucketInstance
@@ -230,6 +228,9 @@ func TestBucketGet(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
+
 			var objs []client.Object
 			for _, bi := range tt.instances {
 				b := bucket(bi.name, bi.project, bi.location)
@@ -242,35 +243,34 @@ func TestBucketGet(t *testing.T) {
 				objs = append(objs, &b)
 			}
 
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(objs...),
 				test.WithObjects(objs...),
 				test.WithNameIndexFor(&storage.Bucket{}),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			require.NoError(t, err)
 
 			buf := &bytes.Buffer{}
 			cmd := tt.getCmd
 			get := NewTestCmd(buf, tt.out)
 			get.AllProjects = tt.inAllProjects
-			err = cmd.Run(ctx, apiClient, get)
+			err := cmd.Run(t.Context(), apiClient, get)
 
 			if tt.wantErr {
-				require.Error(t, err)
+				is.Error(err)
 				for _, s := range tt.wantContain {
-					assert.Contains(t, strings.ToLower(err.Error()), strings.ToLower(s), "missing expected substring %q in error:\n%s", s, err)
+					is.Contains(strings.ToLower(err.Error()), strings.ToLower(s), "missing expected substring %q in error:\n%s", s, err)
 				}
 				return
 			}
-			require.NoError(t, err, buf.String())
+			is.NoError(err, buf.String())
 
 			outStr := buf.String()
 			for _, s := range tt.wantContain {
-				assert.Contains(t, outStr, s, "missing expected substring %q in output:\n%s", s, outStr)
+				is.Contains(outStr, s, "missing expected substring %q in output:\n%s", s, outStr)
 			}
 			if tt.wantLines > 0 {
-				assert.Equal(t, tt.wantLines, test.CountLines(outStr), "unexpected number of lines:\n%s", outStr)
+				is.Equal(tt.wantLines, test.CountLines(outStr), "unexpected number of lines:\n%s", outStr)
 			}
 		})
 	}
diff --git a/get/bucketuser_test.go b/get/bucketuser_test.go
index aef6ce3c..12fc7835 100644
--- a/get/bucketuser_test.go
+++ b/get/bucketuser_test.go
@@ -2,25 +2,24 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"strings"
 	"testing"
 
 	meta "github.com/ninech/apis/meta/v1alpha1"
 	storage "github.com/ninech/apis/storage/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 func TestBucketUser(t *testing.T) {
+	t.Parallel()
+
 	type buInstance struct {
 		name     string
 		project  string
 		location meta.LocationName
 	}
-	ctx := context.Background()
 	tests := []struct {
 		name          string
 		instances     []buInstance
@@ -113,23 +112,23 @@ func TestBucketUser(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			objects := []client.Object{}
 			for _, bu := range tt.instances {
 				created := bucketUser(bu.name, bu.project, bu.location)
 				objects = append(objects, created)
 			}
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(objects...),
 				test.WithObjects(objects...),
 				test.WithNameIndexFor(&storage.BucketUser{}),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			require.NoError(t, err)
-
 			buf := &bytes.Buffer{}
 			cmd := NewTestCmd(buf, tt.out)
 			cmd.AllProjects = tt.inAllProjects
-			err = tt.get.Run(ctx, apiClient, cmd)
+			err := tt.get.Run(t.Context(), apiClient, cmd)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("bucketUserCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 				t.Log(buf.String())
diff --git a/get/build_test.go b/get/build_test.go
index 9cd8ad7a..da284229 100644
--- a/get/build_test.go
+++ b/get/build_test.go
@@ -2,18 +2,18 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"testing"
 
 	apps "github.com/ninech/apis/apps/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 func TestBuild(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
+	is := require.New(t)
+
 	build := apps.Build{
 		TypeMeta: metav1.TypeMeta{
 			Kind:       apps.BuildKind,
@@ -31,32 +31,31 @@ func TestBuild(t *testing.T) {
 	buf := &bytes.Buffer{}
 	get := NewTestCmd(buf, full)
 
-	apiClient, err := test.SetupClient(
+	apiClient := test.SetupClient(t,
 		test.WithNameIndexFor(&apps.Build{}),
 		test.WithObjects(&build, &build2),
 	)
-	require.NoError(t, err)
 
 	cmd := buildCmd{}
-	if err := cmd.Run(ctx, apiClient, get); err != nil {
+	if err := cmd.Run(t.Context(), apiClient, get); err != nil {
 		t.Fatal(err)
 	}
 
-	assert.Equal(t, 3, test.CountLines(buf.String()))
+	is.Equal(3, test.CountLines(buf.String()))
 	buf.Reset()
 
 	cmd.Name = build.Name
-	if err := cmd.Run(ctx, apiClient, get); err != nil {
+	if err := cmd.Run(t.Context(), apiClient, get); err != nil {
 		t.Fatal(err)
 	}
 
-	assert.Equal(t, 2, test.CountLines(buf.String()))
+	is.Equal(2, test.CountLines(buf.String()))
 	buf.Reset()
 
 	get.Format = noHeader
-	if err := cmd.Run(ctx, apiClient, get); err != nil {
+	if err := cmd.Run(t.Context(), apiClient, get); err != nil {
 		t.Fatal(err)
 	}
 
-	assert.Equal(t, 1, test.CountLines(buf.String()))
+	is.Equal(1, test.CountLines(buf.String()))
 }
diff --git a/get/cloudvm_test.go b/get/cloudvm_test.go
index 929c80ca..af5bb414 100644
--- a/get/cloudvm_test.go
+++ b/get/cloudvm_test.go
@@ -2,23 +2,22 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"strings"
 	"testing"
 
 	infrastructure "github.com/ninech/apis/infrastructure/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 func TestCloudVM(t *testing.T) {
+	t.Parallel()
+
 	type cvmInstance struct {
 		name       string
 		project    string
 		powerState infrastructure.VirtualMachinePowerState
 	}
-	ctx := context.Background()
 	tests := []struct {
 		name          string
 		instances     []cvmInstance
@@ -111,24 +110,24 @@ func TestCloudVM(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			objects := []client.Object{}
 			for _, cvm := range tt.instances {
 				created := test.CloudVirtualMachine(cvm.name, cvm.project, "nine-es34", cvm.powerState)
 				created.Status.AtProvider.PowerState = cvm.powerState
 				objects = append(objects, created)
 			}
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(objects...),
 				test.WithObjects(objects...),
 				test.WithNameIndexFor(&infrastructure.CloudVirtualMachine{}),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			require.NoError(t, err)
-
 			buf := &bytes.Buffer{}
 			cmd := NewTestCmd(buf, tt.out)
 			cmd.AllProjects = tt.inAllProjects
-			err = tt.get.Run(ctx, apiClient, cmd)
+			err := tt.get.Run(t.Context(), apiClient, cmd)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("cloudVMCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 				t.Log(buf.String())
diff --git a/get/database_test.go b/get/database_test.go
index de9a7cbb..040e075b 100644
--- a/get/database_test.go
+++ b/get/database_test.go
@@ -2,14 +2,12 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"strings"
 	"testing"
 
 	meta "github.com/ninech/apis/meta/v1alpha1"
 	storage "github.com/ninech/apis/storage/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -17,7 +15,7 @@ import (
 
 // TestDatabase tests shared functionality between different database types, with a postgresdatabase
 func TestDatabase(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
 	type postgresDatabase struct {
 		name     string
@@ -138,6 +136,8 @@ func TestDatabase(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			objects := []client.Object{}
 			for _, database := range tt.databases {
 				created := test.PostgresDatabase(database.name, database.project, "nine-es34")
@@ -150,21 +150,19 @@ func TestDatabase(t *testing.T) {
 					Data: map[string][]byte{"foo_bar": []byte("topsecret")},
 				})
 			}
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(objects...),
 				test.WithObjects(objects...),
 				test.WithNameIndexFor(&storage.PostgresDatabase{}),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			require.NoError(t, err)
-
 			if tt.out == "" {
 				tt.out = full
 			}
 			buf := &bytes.Buffer{}
 			cmd := NewTestCmd(buf, tt.out)
 			cmd.AllProjects = tt.inAllProjects
-			err = tt.get.Run(ctx, apiClient, cmd)
+			err := tt.get.Run(t.Context(), apiClient, cmd)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("postgresDatabaseCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
diff --git a/get/get_test.go b/get/get_test.go
index 0ce6a725..2d0c1d20 100644
--- a/get/get_test.go
+++ b/get/get_test.go
@@ -34,6 +34,8 @@ func NewTestCmd(w io.Writer, outFormat outputFormat, opts ...func(*Cmd)) *Cmd {
 }
 
 func TestListPrint(t *testing.T) {
+	t.Parallel()
+
 	tests := map[string]struct {
 		out               outputFormat
 		inAllProjects     bool
@@ -87,13 +89,15 @@ func TestListPrint(t *testing.T) {
 	}
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
-			apiClient, err := test.SetupClient(
+			t.Parallel()
+			is := require.New(t)
+
+			apiClient := test.SetupClient(t,
 				test.WithDefaultProject(test.DefaultProject),
 				test.WithProjectsFromResources(append(tc.existingResources, tc.toCreate...)...),
 				test.WithObjects(tc.existingResources...),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			require.NoError(t, err)
 
 			buf := &bytes.Buffer{}
 			cmd := NewTestCmd(buf, tc.out)
@@ -112,7 +116,7 @@ func TestListPrint(t *testing.T) {
 			// delay the creation so watch is running
 			time.Sleep(time.Millisecond * 10)
 			for _, res := range tc.toCreate {
-				require.NoError(t, apiClient.Create(ctx, res))
+				is.NoError(apiClient.Create(ctx, res))
 			}
 			wg.Wait()
 			if tc.wantErr {
diff --git a/get/keyvaluestore_test.go b/get/keyvaluestore_test.go
index 145bf916..b88692ae 100644
--- a/get/keyvaluestore_test.go
+++ b/get/keyvaluestore_test.go
@@ -2,13 +2,11 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"strings"
 	"testing"
 
 	storage "github.com/ninech/apis/storage/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -16,7 +14,7 @@ import (
 )
 
 func TestKeyValueStore(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
 	type kvsInstance struct {
 		name    string
@@ -145,6 +143,8 @@ func TestKeyValueStore(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			objects := []client.Object{}
 			for _, instance := range tt.instances {
 				created := test.KeyValueStore(instance.name, instance.project, "nine-es34")
@@ -158,18 +158,16 @@ func TestKeyValueStore(t *testing.T) {
 					Data: map[string][]byte{"default": []byte(created.GetWriteConnectionSecretToReference().Name + "-topsecret")},
 				})
 			}
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(objects...),
 				test.WithObjects(objects...),
 				test.WithNameIndexFor(&storage.KeyValueStore{}),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			require.NoError(t, err)
-
 			buf := &bytes.Buffer{}
 			cmd := NewTestCmd(buf, tt.out)
 			cmd.AllProjects = tt.inAllProjects
-			err = tt.get.Run(ctx, apiClient, cmd)
+			err := tt.get.Run(t.Context(), apiClient, cmd)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("keyValueStoreCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
diff --git a/get/mysql_test.go b/get/mysql_test.go
index 09eb918a..72817412 100644
--- a/get/mysql_test.go
+++ b/get/mysql_test.go
@@ -2,21 +2,19 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"strings"
 	"testing"
 
 	infra "github.com/ninech/apis/infrastructure/v1alpha1"
 	storage "github.com/ninech/apis/storage/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 func TestMySQL(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
 	type mysqlInstance struct {
 		name        string
@@ -137,6 +135,8 @@ func TestMySQL(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			objects := []client.Object{}
 			for _, instance := range tt.instances {
 				created := test.MySQL(instance.name, instance.project, "nine-es34")
@@ -150,21 +150,19 @@ func TestMySQL(t *testing.T) {
 				})
 			}
 
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(objects...),
 				test.WithObjects(objects...),
 				test.WithNameIndexFor(&storage.MySQL{}),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			require.NoError(t, err)
-
 			if tt.out == "" {
 				tt.out = full
 			}
 			buf := &bytes.Buffer{}
 			cmd := NewTestCmd(buf, tt.out)
 			cmd.AllProjects = tt.inAllProjects
-			err = tt.get.Run(ctx, apiClient, cmd)
+			err := tt.get.Run(t.Context(), apiClient, cmd)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("mySQLCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
diff --git a/get/mysqldatabase_test.go b/get/mysqldatabase_test.go
index ce720703..b58a1997 100644
--- a/get/mysqldatabase_test.go
+++ b/get/mysqldatabase_test.go
@@ -2,21 +2,19 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"strings"
 	"testing"
 
 	meta "github.com/ninech/apis/meta/v1alpha1"
 	storage "github.com/ninech/apis/storage/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 func TestMySQLDatabase(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
 	type mysqlDatabase struct {
 		name         string
@@ -65,6 +63,8 @@ func TestMySQLDatabase(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			objects := []client.Object{}
 			for _, database := range tt.databases {
 				created := test.MySQLDatabase(database.name, database.project, "nine-es34")
@@ -78,13 +78,12 @@ func TestMySQLDatabase(t *testing.T) {
 					Data: map[string][]byte{"foo_bar": []byte("topsecret")},
 				})
 			}
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(objects...),
 				test.WithObjects(objects...),
 				test.WithNameIndexFor(&storage.MySQLDatabase{}),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			require.NoError(t, err)
 
 			if tt.out == "" {
 				tt.out = full
@@ -93,7 +92,7 @@ func TestMySQLDatabase(t *testing.T) {
 			buf := &bytes.Buffer{}
 			cmd := NewTestCmd(buf, tt.out)
 			cmd.AllProjects = tt.inAllProjects
-			if err := tt.get.Run(ctx, apiClient, cmd); (err != nil) != tt.wantErr {
+			if err := tt.get.Run(t.Context(), apiClient, cmd); (err != nil) != tt.wantErr {
 				t.Errorf("mysqlDatabaseCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
 			if tt.wantErr {
diff --git a/get/opensearch_test.go b/get/opensearch_test.go
index dc886055..e25dfcf2 100644
--- a/get/opensearch_test.go
+++ b/get/opensearch_test.go
@@ -2,7 +2,6 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"fmt"
 	"strings"
 	"testing"
@@ -11,14 +10,13 @@ import (
 	meta "github.com/ninech/apis/meta/v1alpha1"
 	storage "github.com/ninech/apis/storage/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 func TestOpenSearch(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
 	type openSearchInstance struct {
 		name           string
@@ -186,6 +184,8 @@ func TestOpenSearch(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			buf := &bytes.Buffer{}
 
 			objects := []client.Object{}
@@ -230,20 +230,19 @@ func TestOpenSearch(t *testing.T) {
 					Data: map[string][]byte{storage.OpenSearchUser: []byte(created.GetWriteConnectionSecretToReference().Name + "-topsecret")},
 				})
 			}
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(objects...),
 				test.WithObjects(objects...),
 				test.WithNameIndexFor(&storage.OpenSearch{}),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			require.NoError(t, err)
 
 			if tt.out == "" {
 				tt.out = full
 			}
 			cmd := NewTestCmd(buf, tt.out)
 			cmd.AllProjects = tt.inAllProjects
-			err = tt.get.Run(ctx, apiClient, cmd)
+			err := tt.get.Run(t.Context(), apiClient, cmd)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("openSearchCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
@@ -270,6 +269,8 @@ func TestOpenSearch(t *testing.T) {
 }
 
 func TestGetClusterHealth(t *testing.T) {
+	t.Parallel()
+
 	cmd := &openSearchCmd{}
 
 	tests := []struct {
@@ -366,6 +367,8 @@ func TestGetClusterHealth(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			got := string(cmd.getClusterHealth(tt.clusterHealth))
 			if got != tt.want {
 				t.Errorf("getClusterHealth() = %v, want %v", got, tt.want)
diff --git a/get/postgres_test.go b/get/postgres_test.go
index 5ebecbb8..28cb7239 100644
--- a/get/postgres_test.go
+++ b/get/postgres_test.go
@@ -2,21 +2,19 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"strings"
 	"testing"
 
 	infra "github.com/ninech/apis/infrastructure/v1alpha1"
 	storage "github.com/ninech/apis/storage/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 func TestPostgres(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
 	type postgresInstance struct {
 		name        string
@@ -137,6 +135,8 @@ func TestPostgres(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			objects := []client.Object{}
 			for _, instance := range tt.instances {
 				created := test.Postgres(instance.name, instance.project, "nine-es34")
@@ -149,13 +149,12 @@ func TestPostgres(t *testing.T) {
 					Data: map[string][]byte{storage.PostgresUser: []byte(created.GetWriteConnectionSecretToReference().Name + "-topsecret")},
 				})
 			}
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(objects...),
 				test.WithObjects(objects...),
 				test.WithNameIndexFor(&storage.Postgres{}),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			require.NoError(t, err)
 
 			if tt.out == "" {
 				tt.out = full
@@ -163,7 +162,7 @@ func TestPostgres(t *testing.T) {
 			buf := &bytes.Buffer{}
 			cmd := NewTestCmd(buf, tt.out)
 			cmd.AllProjects = tt.inAllProjects
-			err = tt.get.Run(ctx, apiClient, cmd)
+			err := tt.get.Run(t.Context(), apiClient, cmd)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("postgresCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
diff --git a/get/postgresdatabase_test.go b/get/postgresdatabase_test.go
index 6c416892..7959506e 100644
--- a/get/postgresdatabase_test.go
+++ b/get/postgresdatabase_test.go
@@ -2,21 +2,19 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"strings"
 	"testing"
 
 	meta "github.com/ninech/apis/meta/v1alpha1"
 	storage "github.com/ninech/apis/storage/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 func TestPostgresDatabase(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
 	type postgresDatabase struct {
 		name     string
@@ -64,6 +62,8 @@ func TestPostgresDatabase(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			objects := []client.Object{}
 			for _, database := range tt.databases {
 				created := test.PostgresDatabase(database.name, database.project, "nine-es34")
@@ -76,13 +76,12 @@ func TestPostgresDatabase(t *testing.T) {
 					Data: map[string][]byte{"foo_bar": []byte("topsecret")},
 				})
 			}
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(objects...),
 				test.WithObjects(objects...),
 				test.WithNameIndexFor(&storage.PostgresDatabase{}),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			require.NoError(t, err)
 
 			if tt.out == "" {
 				tt.out = full
@@ -90,7 +89,7 @@ func TestPostgresDatabase(t *testing.T) {
 			buf := &bytes.Buffer{}
 			cmd := NewTestCmd(buf, tt.out)
 			cmd.AllProjects = tt.inAllProjects
-			if err := tt.get.Run(ctx, apiClient, cmd); (err != nil) != tt.wantErr {
+			if err := tt.get.Run(t.Context(), apiClient, cmd); (err != nil) != tt.wantErr {
 				t.Errorf("postgresDatabaseCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
 			if tt.wantErr {
diff --git a/get/project_config_test.go b/get/project_config_test.go
index 40729e45..a7b51c4c 100644
--- a/get/project_config_test.go
+++ b/get/project_config_test.go
@@ -9,7 +9,6 @@ import (
 	apps "github.com/ninech/apis/apps/v1alpha1"
 	"github.com/ninech/nctl/api/util"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
@@ -123,36 +122,37 @@ func TestProjectConfigs(t *testing.T) {
 
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
-			apiClient, err := test.SetupClient(
+			is := require.New(t)
+
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(tc.createdConfigs...),
 				test.WithObjects(tc.createdConfigs...),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 				test.WithDefaultProject(tc.project),
 				test.WithNameIndexFor(&apps.ProjectConfig{}),
 			)
-			require.NoError(t, err)
 
 			buf := &bytes.Buffer{}
 			tc.get.BeforeApply(buf)
 			cmd := configsCmd{}
 
-			err = cmd.Run(t.Context(), apiClient, tc.get)
+			err := cmd.Run(t.Context(), apiClient, tc.get)
 			if len(tc.errorContains) > 0 {
-				require.Error(t, err)
+				is.Error(err)
 				for _, s := range tc.errorContains {
-					assert.Contains(t, strings.ToLower(err.Error()), strings.ToLower(s))
+					is.Contains(strings.ToLower(err.Error()), strings.ToLower(s))
 				}
 				return
 			}
-			require.NoError(t, err)
+			is.NoError(err)
 			if tc.expectedLineAmountInOutput != nil {
-				assert.Equal(t, *tc.expectedLineAmountInOutput, test.CountLines(buf.String()), buf.String())
+				is.Equal(*tc.expectedLineAmountInOutput, test.CountLines(buf.String()), buf.String())
 			}
 
 			if tc.expectExactMessage == nil {
 				return
 			}
-			assert.Equal(t, buf.String(), *tc.expectExactMessage, buf.String())
+			is.Equal(*tc.expectExactMessage, buf.String(), buf.String())
 		})
 	}
 }
diff --git a/get/project_test.go b/get/project_test.go
index a57b1fd0..b0f82b68 100644
--- a/get/project_test.go
+++ b/get/project_test.go
@@ -2,7 +2,6 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"os"
 	"strings"
 	"testing"
@@ -10,14 +9,12 @@ import (
 	management "github.com/ninech/apis/management/v1alpha1"
 	"github.com/ninech/nctl/api/config"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 func TestProject(t *testing.T) {
 	t.Parallel()
-	ctx := context.Background()
 	organization := "evilcorp"
 
 	for name, testCase := range map[string]struct {
@@ -138,7 +135,9 @@ dev      <none>
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
-			testCase := testCase
+			t.Parallel()
+
+			is := require.New(t)
 
 			buf := &bytes.Buffer{}
 			get := NewTestCmd(buf, testCase.outputFormat)
@@ -151,13 +150,12 @@ dev      <none>
 				}
 				proj.(*management.Project).Spec.DisplayName = testCase.displayNames[i]
 			}
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithObjects(projects...),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 				test.WithNameIndexFor(&management.Project{}),
 				test.WithOrganization(organization),
 			)
-			require.NoError(t, err)
 
 			cmd := projectCmd{
 				resourceCmd: resourceCmd{
@@ -165,27 +163,26 @@ dev      <none>
 				},
 			}
 
-			err = cmd.Run(ctx, apiClient, get)
+			err := cmd.Run(t.Context(), apiClient, get)
 			if len(testCase.errorContains) > 0 {
-				require.Error(t, err)
+				is.Error(err)
 				for _, s := range testCase.errorContains {
-					assert.Contains(t, strings.ToLower(err.Error()), strings.ToLower(s))
+					is.Contains(strings.ToLower(err.Error()), strings.ToLower(s))
 				}
 				return
 			}
-			require.NoError(t, err)
+			is.NoError(err)
 
-			assert.Equal(t, testCase.output, buf.String())
+			is.Equal(testCase.output, buf.String())
 		})
 	}
 }
 
 func TestProjectsConfigErrors(t *testing.T) {
-	ctx := context.Background()
-	apiClient, err := test.SetupClient()
-	if err != nil {
-		t.Fatal(err)
-	}
+	t.Parallel()
+
+	is := require.New(t)
+	apiClient := test.SetupClient(t)
 	cmd := projectCmd{
 		resourceCmd: resourceCmd{
 			Name: "testproject",
@@ -195,12 +192,12 @@ func TestProjectsConfigErrors(t *testing.T) {
 		output: output{Format: full},
 	}
 	// there is no kubeconfig so we expect to fail
-	require.Error(t, cmd.Run(ctx, apiClient, get))
+	is.Error(cmd.Run(t.Context(), apiClient, get))
 
 	// we create a kubeconfig which does not contain a nctl config
 	// extension
 	kubeconfig, err := test.CreateTestKubeconfig(apiClient, "")
-	require.NoError(t, err)
+	is.NoError(err)
 	defer os.Remove(kubeconfig)
-	require.ErrorIs(t, cmd.Run(ctx, apiClient, get), config.ErrExtensionNotFound)
+	is.ErrorIs(cmd.Run(t.Context(), apiClient, get), config.ErrExtensionNotFound)
 }
diff --git a/get/releases_test.go b/get/releases_test.go
index 1875c41a..4339bb86 100644
--- a/get/releases_test.go
+++ b/get/releases_test.go
@@ -2,7 +2,6 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"fmt"
 	"sort"
 	"strings"
@@ -14,7 +13,6 @@ import (
 	meta "github.com/ninech/apis/meta/v1alpha1"
 	"github.com/ninech/nctl/api/util"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -23,8 +21,8 @@ import (
 var defaultCreationTime = metav1.NewTime(test.MustParseTime(time.RFC3339, "2023-03-13T14:00:00Z"))
 
 func TestReleases(t *testing.T) {
+	t.Parallel()
 	const project = test.DefaultProject
-	ctx := context.Background()
 
 	cases := map[string]struct {
 		cmd           releasesCmd
@@ -154,6 +152,8 @@ func TestReleases(t *testing.T) {
 
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
 			// we initialize the client with objects in different
 			// order than CreationTimestampNano - we sort them by
 			// CreationTimestamp which is quite "random" here.
@@ -161,13 +161,12 @@ func TestReleases(t *testing.T) {
 			// allows to test the prepare Releases output logic.
 			releasesByCreationTime := copyAndSortReleasesByCreationTime(tc.releases)
 
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(releasesByCreationTime...),
 				test.WithObjects(releasesByCreationTime...),
 				test.WithNameIndexFor(&apps.Release{}),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			require.NoError(t, err)
 
 			if tc.output == "" {
 				tc.output = full
@@ -176,7 +175,7 @@ func TestReleases(t *testing.T) {
 			get := NewTestCmd(buf, tc.output)
 			get.AllProjects = tc.inAllProjects
 
-			err = tc.cmd.Run(ctx, apiClient, get)
+			err := tc.cmd.Run(t.Context(), apiClient, get)
 			if (err != nil) != tc.wantErr {
 				t.Errorf("releasesCmd.Run() error = %v, wantErr %v", err, tc.wantErr)
 			}
diff --git a/get/serviceconnection_test.go b/get/serviceconnection_test.go
index 178a953c..c17063c5 100644
--- a/get/serviceconnection_test.go
+++ b/get/serviceconnection_test.go
@@ -2,18 +2,16 @@ package get
 
 import (
 	"bytes"
-	"context"
 	"strings"
 	"testing"
 
 	networking "github.com/ninech/apis/networking/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 func TestServiceConnection(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
 
 	type serviceConnectionInstance struct {
 		name        string
@@ -104,6 +102,8 @@ func TestServiceConnection(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			objects := []client.Object{}
 			for _, instance := range tt.instances {
 				created := test.ServiceConnection(instance.name, instance.project)
@@ -112,21 +112,19 @@ func TestServiceConnection(t *testing.T) {
 				objects = append(objects, created)
 			}
 
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithProjectsFromResources(objects...),
 				test.WithObjects(objects...),
 				test.WithNameIndexFor(&networking.ServiceConnection{}),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			require.NoError(t, err)
-
 			if tt.out == "" {
 				tt.out = full
 			}
 			buf := &bytes.Buffer{}
 			cmd := NewTestCmd(buf, tt.out)
 			cmd.AllProjects = tt.inAllProjects
-			err = tt.get.Run(ctx, apiClient, cmd)
+			err := tt.get.Run(t.Context(), apiClient, cmd)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("serviceConnectionCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
diff --git a/go.mod b/go.mod
index 0085ffbf..294911bc 100644
--- a/go.mod
+++ b/go.mod
@@ -35,7 +35,6 @@ require (
 	golang.org/x/exp v0.0.0-20260209203927-2842357ff358
 	golang.org/x/oauth2 v0.35.0
 	golang.org/x/sync v0.19.0
-	gotest.tools v2.2.0+incompatible
 	k8s.io/api v0.35.0
 	k8s.io/apimachinery v0.35.0
 	k8s.io/client-go v0.35.0
diff --git a/go.sum b/go.sum
index 6518f2d9..90e0d708 100644
--- a/go.sum
+++ b/go.sum
@@ -1059,7 +1059,6 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
-gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
 gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
 k8s.io/api v0.35.0 h1:iBAU5LTyBI9vw3L5glmat1njFK34srdLmktWwLTprlY=
diff --git a/internal/cli/error.go b/internal/cli/error.go
index a1a3fdf9..af9e8cbd 100644
--- a/internal/cli/error.go
+++ b/internal/cli/error.go
@@ -8,14 +8,34 @@ import (
 )
 
 // Exit codes following the square/exit convention.
-// See https://github.com/square/exit for details.
+// See https://pkg.go.dev/github.com/square/exit#readme-the-codes for details.
 const (
-	ExitOK            = 0   // successful execution
-	ExitError         = 1   // generic error
-	ExitUsageError    = 80  // invalid input, validation errors
-	ExitForbidden     = 83  // permission denied
-	ExitInternalError = 100 // bug in nctl
-	ExitUnavailable   = 101 // API/service unreachable
+	// ExitOK indicates that the program exited successfully.
+	ExitOK = 0
+	// ExitError indicates that the program exited unsuccessfully
+	// but gives no extra context as to what the failure was.
+	ExitError = 1
+	// ExitUsageError indicates that the program exited unsuccessfully
+	// because it was used incorrectly.
+	//
+	// Examples: a required argument was omitted or an invalid value
+	// was supplied for a flag.
+	ExitUsageError = 80
+	// ExitForbidden indicates that the program exited unsuccessfully
+	// because the user isn't authorized to perform the requested action.
+	ExitForbidden = 83
+	// ExitInternalError indicates that the program exited unsuccessfully
+	// because of a problem in its own code.
+	//
+	// Used instead of 1 when the problem is known to be with the program's
+	// code or dependencies.
+	ExitInternalError = 100
+	// ExitUnavailable indicates that the program exited unsuccessfully
+	// because a service it depends on was not available.
+	//
+	// Examples: A local daemon or remote service did not respond, a connection
+	// was closed unexpectedly, an HTTP service responded with 503.
+	ExitUnavailable = 101
 )
 
 // Error wraps an error with additional context for user-friendly display.
diff --git a/internal/format/interpolation_test.go b/internal/format/interpolation_test.go
index 9ae14785..4ba6485d 100644
--- a/internal/format/interpolation_test.go
+++ b/internal/format/interpolation_test.go
@@ -5,10 +5,11 @@ import (
 
 	"github.com/alecthomas/kong"
 	"github.com/stretchr/testify/require"
-	"gotest.tools/assert"
 )
 
 func TestPlaceholderInterpolation(t *testing.T) {
+	t.Parallel()
+
 	var cli struct {
 		FlagPointer *string `placeholder:"${flag_default}"`
 		Flag        string  `default:"${flag_default}"`
@@ -27,22 +28,25 @@ func TestPlaceholderInterpolation(t *testing.T) {
 		vars,
 		kong.PostBuild(InterpolateFlagPlaceholders(vars)),
 	)
-	require.NoError(t, err)
+	is := require.New(t)
+	is.NoError(err)
 	// we expect 3 flags because the first one is always the "-h" help flag
-	require.Len(t, p.Model.Flags, 3)
+	is.Len(p.Model.Flags, 3)
 	flagPointer := p.Model.Flags[1]
-	assert.Equal(t, "chicken", flagPointer.PlaceHolder)
+	is.Equal("chicken", flagPointer.PlaceHolder)
 	// we expect one sub command
-	require.Len(t, p.Model.Children, 1)
+	is.Len(p.Model.Children, 1)
 	// no help flag this time...
-	require.Len(t, p.Model.Children[0].Flags, 2)
+	is.Len(p.Model.Children[0].Flags, 2)
 	subFlagPointer := p.Model.Children[0].Flags[1]
-	require.Equal(t, "coleslaw!", subFlagPointer.PlaceHolder)
+	is.Equal("coleslaw!", subFlagPointer.PlaceHolder)
 }
 
 // TestPlaceholderInterpolationError makes sure that an error gets thrown if a
 // variable in a placeholder was not defined
 func TestPlaceholderInterpolationError(t *testing.T) {
+	t.Parallel()
+
 	var cli struct {
 		FlagPointer *string `placeholder:"${flag_default}"`
 	}
@@ -50,5 +54,6 @@ func TestPlaceholderInterpolationError(t *testing.T) {
 		&cli,
 		kong.PostBuild(InterpolateFlagPlaceholders(kong.Vars{"unused": "garbage"})),
 	)
-	require.Error(t, err)
+	is := require.New(t)
+	is.Error(err)
 }
diff --git a/internal/format/reader_test.go b/internal/format/reader_test.go
index 97ff1ee4..ada3abc6 100644
--- a/internal/format/reader_test.go
+++ b/internal/format/reader_test.go
@@ -5,13 +5,12 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestNewReader(t *testing.T) {
 	t.Parallel()
-	is := assert.New(t)
+	is := require.New(t)
 
 	input := strings.NewReader("test input")
 	reader := NewReader(input)
@@ -52,10 +51,10 @@ func TestReader_BeforeApply(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			is := assert.New(t)
+			is := require.New(t)
 
 			err := tt.reader.BeforeApply(tt.input)
-			require.NoError(t, err)
+			is.NoError(err)
 
 			if tt.reader != nil {
 				is.Equal(tt.expectReader, tt.reader.Reader)
@@ -66,7 +65,7 @@ func TestReader_BeforeApply(t *testing.T) {
 
 func TestReader_Read(t *testing.T) {
 	t.Parallel()
-	is := assert.New(t)
+	is := require.New(t)
 
 	input := strings.NewReader("hello")
 	reader := NewReader(input)
@@ -74,7 +73,7 @@ func TestReader_Read(t *testing.T) {
 	buf := make([]byte, 5)
 	n, err := reader.Read(buf)
 
-	require.NoError(t, err)
+	is.NoError(err)
 	is.Equal(5, n)
 	is.Equal("hello", string(buf))
 }
diff --git a/internal/format/writer_test.go b/internal/format/writer_test.go
index 9e186e59..26166d4d 100644
--- a/internal/format/writer_test.go
+++ b/internal/format/writer_test.go
@@ -6,13 +6,12 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestNewWriter(t *testing.T) {
 	t.Parallel()
-	is := assert.New(t)
+	is := require.New(t)
 
 	buf := &bytes.Buffer{}
 	writer := NewWriter(buf)
@@ -53,10 +52,10 @@ func TestWriter_BeforeApply(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			is := assert.New(t)
+			is := require.New(t)
 
 			err := tt.writer.BeforeApply(tt.input)
-			require.NoError(t, err)
+			is.NoError(err)
 
 			if tt.writer != nil {
 				is.Equal(tt.expectWriter, tt.writer.Writer)
@@ -88,7 +87,7 @@ func TestWriter_writer(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			is := assert.New(t)
+			is := require.New(t)
 
 			w := tt.writer.writer()
 			is.Equal(tt.expect, w)
@@ -119,7 +118,7 @@ func TestWriter_Print(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			is := assert.New(t)
+			is := require.New(t)
 
 			buf := &bytes.Buffer{}
 			writer := NewWriter(buf)
@@ -163,7 +162,7 @@ func TestWriter_FormattedOutput(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			is := assert.New(t)
+			is := require.New(t)
 
 			buf := &bytes.Buffer{}
 			writer := NewWriter(buf)
@@ -209,7 +208,7 @@ func TestConfirm(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			is := assert.New(t)
+			is := require.New(t)
 
 			output := &bytes.Buffer{}
 			writer := NewWriter(output)
@@ -222,7 +221,7 @@ func TestConfirm(t *testing.T) {
 				return
 			}
 
-			require.NoError(t, err)
+			is.NoError(err)
 			is.Equal(tt.expected, result)
 			is.Contains(output.String(), "Continue? [y|n]:")
 		})
diff --git a/internal/test/bucket.go b/internal/test/bucket.go
index 1fac1026..a3b47bbd 100644
--- a/internal/test/bucket.go
+++ b/internal/test/bucket.go
@@ -40,10 +40,7 @@ func RunNamedWithFlags(
 	args := append(append([]string{}, cmdPath...), name)
 	args = append(args, flags...)
 
-	apiClient, err := SetupClient(clientOpts...)
-	if err != nil {
-		return nil, name, err
-	}
+	apiClient := SetupClient(t, clientOpts...)
 
 	parser := kong.Must(
 		cli,
diff --git a/internal/test/client.go b/internal/test/client.go
index 8f3cb432..49fde26f 100644
--- a/internal/test/client.go
+++ b/internal/test/client.go
@@ -2,7 +2,6 @@
 package test
 
 import (
-	"fmt"
 	"os"
 	"testing"
 
@@ -31,15 +30,11 @@ type clientSetup struct {
 	defaultProject   string
 	projects         []string
 	objects          []client.Object
-	kubeconfig       *kubeconfigSetup
+	kubeconfig       bool
 	nameIndexesOn    []runtime.Object
 	interceptorFuncs *interceptor.Funcs
 }
 
-type kubeconfigSetup struct {
-	t *testing.T
-}
-
 type ClientSetupOption func(*clientSetup)
 
 func defaultClientSetup() *clientSetup {
@@ -106,9 +101,9 @@ func WithObjects(objects ...client.Object) ClientSetupOption {
 
 // WithKubeconfig creates a fake kubeconfig which gets removed once the passed
 // test finished
-func WithKubeconfig(t *testing.T) ClientSetupOption {
+func WithKubeconfig() ClientSetupOption {
 	return func(cs *clientSetup) {
-		cs.kubeconfig = &kubeconfigSetup{t: t}
+		cs.kubeconfig = true
 	}
 }
 
@@ -125,7 +120,9 @@ func WithInterceptorFuncs(f interceptor.Funcs) ClientSetupOption {
 	}
 }
 
-func SetupClient(opts ...ClientSetupOption) (*api.Client, error) {
+func SetupClient(t *testing.T, opts ...ClientSetupOption) *api.Client {
+	t.Helper()
+
 	setup := defaultClientSetup()
 	for _, opt := range opts {
 		opt(setup)
@@ -133,7 +130,8 @@ func SetupClient(opts ...ClientSetupOption) (*api.Client, error) {
 
 	scheme, err := api.NewScheme()
 	if err != nil {
-		return nil, err
+		t.Errorf("error on scheme creation: %s", err)
+		return nil
 	}
 	resources := []client.Object{namespace(setup.organization)}
 	resources = append(resources, Projects(setup.organization, setup.projects...)...)
@@ -163,23 +161,23 @@ func SetupClient(opts ...ClientSetupOption) (*api.Client, error) {
 		WithWatch: client, Project: setup.defaultProject,
 	}
 
-	if setup.kubeconfig == nil {
-		return c, nil
+	if !setup.kubeconfig {
+		return c
 	}
+
 	fName, err := CreateTestKubeconfig(c, setup.organization)
 	if err != nil {
-		return nil, fmt.Errorf("error on kubeconfig creation: %w", err)
+		t.Errorf("error on kubeconfig creation: %s", err)
+		return nil
 	}
-	if setup.kubeconfig.t == nil {
-		return c, nil
-	}
-	t := setup.kubeconfig.t
+
 	t.Cleanup(func() {
 		if err := os.Remove(fName); err != nil {
 			t.Errorf("can not remove kubeconfig file: %v", err)
 		}
 	})
-	return c, nil
+
+	return c
 }
 
 func namespace(name string) *corev1.Namespace {
diff --git a/logs/logs_test.go b/logs/logs_test.go
index 1464f42b..95821305 100644
--- a/logs/logs_test.go
+++ b/logs/logs_test.go
@@ -2,7 +2,6 @@ package logs
 
 import (
 	"bytes"
-	"context"
 	"encoding/json"
 	"fmt"
 	"strings"
@@ -12,10 +11,12 @@ import (
 	apps "github.com/ninech/apis/apps/v1alpha1"
 	"github.com/ninech/nctl/api"
 	"github.com/ninech/nctl/api/log"
-	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestRun(t *testing.T) {
+	t.Parallel()
+
 	expectedTime := time.Now()
 	lines := []string{}
 
@@ -27,7 +28,6 @@ func TestRun(t *testing.T) {
 		Project: "default",
 		Log:     &log.Client{Client: log.NewFake(t, expectedTime, lines...)},
 	}
-	ctx := context.Background()
 
 	cases := map[string]struct {
 		cmd                 logsCmd
@@ -95,24 +95,25 @@ func TestRun(t *testing.T) {
 
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			is := require.New(t)
+
 			var buf bytes.Buffer
 			out, err := log.NewOutput(&buf, log.Mode(tc.cmd.Output), true)
-			if err != nil {
-				t.Fatal(err)
-			}
+			is.NoError(err)
 
 			tc.cmd.out = out
 
-			if err := tc.cmd.Run(ctx, apiClient, ApplicationQuery("app-name", "app-ns")); err != nil {
+			if err := tc.cmd.Run(t.Context(), apiClient, ApplicationQuery("app-name", "app-ns")); err != nil {
 				if tc.expectedErrContains != "" {
-					assert.ErrorContains(t, err, tc.expectedErrContains)
+					is.ErrorContains(err, tc.expectedErrContains)
 				} else {
-					assert.NoError(t, err)
+					is.NoError(err)
 				}
 			}
 
 			if tc.expectedLines != 0 {
-				assert.Equal(t, out.LineCount(), tc.expectedLines)
+				is.Equal(out.LineCount(), tc.expectedLines)
 			}
 
 			if tc.cmd.Output == "json" {
@@ -123,9 +124,9 @@ func TestRun(t *testing.T) {
 				// iterate lines, unmarshal each and compare them against the input
 				outLines := strings.Split(strings.TrimSuffix(buf.String(), "\n"), "\n")
 				for i, line := range outLines {
-					assert.NoError(t, json.Unmarshal([]byte(line), &logLine))
-					assert.Equal(t, expectedTime.Local(), logLine.Timestamp.Local())
-					assert.Equal(t, lines[i], logLine.Line)
+					is.NoError(json.Unmarshal([]byte(line), &logLine))
+					is.Equal(expectedTime.Local(), logLine.Timestamp.Local())
+					is.Equal(lines[i], logLine.Line)
 				}
 			}
 			buf.Reset()
@@ -134,7 +135,10 @@ func TestRun(t *testing.T) {
 }
 
 func TestMatchLabels(t *testing.T) {
-	assert.Equal(t,
+	t.Parallel()
+	is := require.New(t)
+
+	is.Equal(
 		buildQuery(queryExpr(opEquals, apps.LogLabelApplication, "some-app"), inProject("default")),
 		`{app="some-app",namespace="default"}`,
 	)
diff --git a/main_test.go b/main_test.go
index 3d612c16..249342a3 100644
--- a/main_test.go
+++ b/main_test.go
@@ -9,7 +9,10 @@ import (
 // TestKongVars makes sure that the kongVariables function will not run into an
 // error. As it is based mostly on static input, a simple test should be enough.
 func TestKongVars(t *testing.T) {
+	t.Parallel()
+	is := require.New(t)
+
 	vars, err := kongVariables()
-	require.NoError(t, err)
-	require.NotEmpty(t, vars)
+	is.NoError(err)
+	is.NotEmpty(vars)
 }
diff --git a/predictor/predictor_test.go b/predictor/predictor_test.go
index 73114292..bdf714e1 100644
--- a/predictor/predictor_test.go
+++ b/predictor/predictor_test.go
@@ -153,6 +153,8 @@ func (c *capturePredictor) Predict(args complete.Args) []string {
 }
 
 func TestFindProjectInSlice(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		name string
 		args []string
@@ -207,6 +209,8 @@ func TestFindProjectInSlice(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			if got := findProjectInSlice(tt.args); got != tt.want {
 				t.Errorf("findProjectInSlice() = %q, want %q", got, tt.want)
 			}
diff --git a/update/apiserviceaccount_test.go b/update/apiserviceaccount_test.go
index bf1a532c..686a3916 100644
--- a/update/apiserviceaccount_test.go
+++ b/update/apiserviceaccount_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/ninech/nctl/api"
 	"github.com/ninech/nctl/internal/format"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
 )
@@ -40,7 +40,8 @@ func TestAPIServiceAccount(t *testing.T) {
 				OrganizationAccess: ptr.To(true),
 			},
 			checkAPIServiceAccount: func(t *testing.T, cmd apiServiceAccountCmd, orig, updated *iam.APIServiceAccount) {
-				assert.Equal(t, *cmd.OrganizationAccess, updated.Spec.ForProvider.OrganizationAccess)
+				is := require.New(t)
+				is.Equal(*cmd.OrganizationAccess, updated.Spec.ForProvider.OrganizationAccess)
 			},
 		},
 	} {
@@ -50,15 +51,12 @@ func TestAPIServiceAccount(t *testing.T) {
 			out := &bytes.Buffer{}
 			tc.cmd.Writer = format.NewWriter(out)
 
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithObjects(tc.orig),
 				test.WithOrganization(organization),
 				test.WithDefaultProject(organization),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			if err != nil {
-				t.Fatal(err)
-			}
 
 			if err := tc.cmd.Run(t.Context(), apiClient); err != nil {
 				t.Fatal(err)
diff --git a/update/application_test.go b/update/application_test.go
index d31dfe9c..c541d082 100644
--- a/update/application_test.go
+++ b/update/application_test.go
@@ -1,7 +1,6 @@
 package update
 
 import (
-	"context"
 	"io"
 	"strings"
 	"testing"
@@ -12,7 +11,6 @@ import (
 	"github.com/ninech/nctl/api/util"
 	"github.com/ninech/nctl/create"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -21,7 +19,8 @@ import (
 )
 
 func TestApplication(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
+
 	initialSize := apps.ApplicationSize("micro")
 
 	dummyRSAKey, err := test.GenerateRSAPrivateKey()
@@ -88,7 +87,8 @@ func TestApplication(t *testing.T) {
 				Port: ptr.To(int32(1234)),
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.Equal(t, *cmd.Port, *updated.Spec.ForProvider.Config.Port)
+				is := require.New(t)
+				is.Equal(*cmd.Port, *updated.Spec.ForProvider.Config.Port)
 			},
 		},
 		"port is unchanged when updating unrelated field": {
@@ -100,8 +100,9 @@ func TestApplication(t *testing.T) {
 				Size: ptr.To("newsize"),
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.Equal(t, *orig.Spec.ForProvider.Config.Port, *updated.Spec.ForProvider.Config.Port)
-				assert.NotEqual(t, orig.Spec.ForProvider.Config.Size, updated.Spec.ForProvider.Config.Size)
+				is := require.New(t)
+				is.Equal(*orig.Spec.ForProvider.Config.Port, *updated.Spec.ForProvider.Config.Port)
+				is.NotEqual(orig.Spec.ForProvider.Config.Size, updated.Spec.ForProvider.Config.Size)
 			},
 		},
 		"all field updates": {
@@ -131,32 +132,33 @@ func TestApplication(t *testing.T) {
 				SkipRepoAccessCheck: true,
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.Equal(t, *cmd.Git.URL, updated.Spec.ForProvider.Git.URL)
-				assert.Equal(t, *cmd.Git.SubPath, updated.Spec.ForProvider.Git.SubPath)
-				assert.Equal(t, *cmd.Git.Revision, updated.Spec.ForProvider.Git.Revision)
-				assert.Equal(t, apps.ApplicationSize(*cmd.Size), updated.Spec.ForProvider.Config.Size)
-				assert.Equal(t, *cmd.Port, *updated.Spec.ForProvider.Config.Port)
-				assert.Equal(t, cmd.HealthProbe.PeriodSeconds, updated.Spec.ForProvider.Config.HealthProbe.PeriodSeconds)
-				assert.Equal(t, *cmd.HealthProbe.Path, updated.Spec.ForProvider.Config.HealthProbe.HTTPGet.Path)
-				assert.Equal(t, *cmd.Replicas, *updated.Spec.ForProvider.Config.Replicas)
-				assert.Equal(t, *cmd.BasicAuth, *updated.Spec.ForProvider.Config.EnableBasicAuth)
-				assert.Equal(t, *cmd.Hosts, updated.Spec.ForProvider.Hosts)
-				assert.Equal(t, util.UpdateEnvVars(existingApp.Spec.ForProvider.Config.Env, cmd.Env, cmd.SensitiveEnv, nil), updated.Spec.ForProvider.Config.Env)
-				assert.Equal(t, util.UpdateEnvVars(existingApp.Spec.ForProvider.BuildEnv, cmd.BuildEnv, cmd.SensitiveBuildEnv, nil), updated.Spec.ForProvider.BuildEnv)
+				is := require.New(t)
+				is.Equal(*cmd.Git.URL, updated.Spec.ForProvider.Git.URL)
+				is.Equal(*cmd.Git.SubPath, updated.Spec.ForProvider.Git.SubPath)
+				is.Equal(*cmd.Git.Revision, updated.Spec.ForProvider.Git.Revision)
+				is.Equal(apps.ApplicationSize(*cmd.Size), updated.Spec.ForProvider.Config.Size)
+				is.Equal(*cmd.Port, *updated.Spec.ForProvider.Config.Port)
+				is.Equal(cmd.HealthProbe.PeriodSeconds, updated.Spec.ForProvider.Config.HealthProbe.PeriodSeconds)
+				is.Equal(*cmd.HealthProbe.Path, updated.Spec.ForProvider.Config.HealthProbe.HTTPGet.Path)
+				is.Equal(*cmd.Replicas, *updated.Spec.ForProvider.Config.Replicas)
+				is.Equal(*cmd.BasicAuth, *updated.Spec.ForProvider.Config.EnableBasicAuth)
+				is.Equal(*cmd.Hosts, updated.Spec.ForProvider.Hosts)
+				is.Equal(util.UpdateEnvVars(existingApp.Spec.ForProvider.Config.Env, cmd.Env, cmd.SensitiveEnv, nil), updated.Spec.ForProvider.Config.Env)
+				is.Equal(util.UpdateEnvVars(existingApp.Spec.ForProvider.BuildEnv, cmd.BuildEnv, cmd.SensitiveBuildEnv, nil), updated.Spec.ForProvider.BuildEnv)
 
 				secretKeyEnv := util.EnvVarByName(updated.Spec.ForProvider.Config.Env, "secret")
-				require.NotNil(t, secretKeyEnv, "secret environment variable should exist")
-				require.NotNil(t, secretKeyEnv.Sensitive)
-				assert.Equal(t, "orange", secretKeyEnv.Value)
-				assert.True(t, *secretKeyEnv.Sensitive)
+				is.NotNil(secretKeyEnv, "secret environment variable should exist")
+				is.NotNil(secretKeyEnv.Sensitive)
+				is.Equal("orange", secretKeyEnv.Value)
+				is.True(*secretKeyEnv.Sensitive)
 
-				assert.Equal(t, *cmd.DeployJob.Command, updated.Spec.ForProvider.Config.DeployJob.Command)
-				assert.Equal(t, *cmd.DeployJob.Name, updated.Spec.ForProvider.Config.DeployJob.Name)
-				assert.Equal(t, *cmd.DeployJob.Timeout, updated.Spec.ForProvider.Config.DeployJob.Timeout.Duration)
-				assert.Equal(t, *cmd.DeployJob.Retries, *updated.Spec.ForProvider.Config.DeployJob.Retries)
+				is.Equal(*cmd.DeployJob.Command, updated.Spec.ForProvider.Config.DeployJob.Command)
+				is.Equal(*cmd.DeployJob.Name, updated.Spec.ForProvider.Config.DeployJob.Name)
+				is.Equal(*cmd.DeployJob.Timeout, updated.Spec.ForProvider.Config.DeployJob.Timeout.Duration)
+				is.Equal(*cmd.DeployJob.Retries, *updated.Spec.ForProvider.Config.DeployJob.Retries)
 				// Retry Release/Build should be not set by default:
-				assert.Nil(t, util.EnvVarByName(updated.Spec.ForProvider.Config.Env, ReleaseTrigger))
-				assert.Nil(t, util.EnvVarByName(updated.Spec.ForProvider.BuildEnv, BuildTrigger))
+				is.Nil(util.EnvVarByName(updated.Spec.ForProvider.Config.Env, ReleaseTrigger))
+				is.Nil(util.EnvVarByName(updated.Spec.ForProvider.BuildEnv, BuildTrigger))
 			},
 		},
 		"reset custom health probe": {
@@ -179,7 +181,8 @@ func TestApplication(t *testing.T) {
 				DeleteHealthProbe: ptr.To(true),
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.Empty(t, updated.Spec.ForProvider.Config.HealthProbe)
+				is := require.New(t)
+				is.Empty(updated.Spec.ForProvider.Config.HealthProbe)
 			},
 		},
 		"no-op when delete custom health probe set false": {
@@ -202,8 +205,9 @@ func TestApplication(t *testing.T) {
 				DeleteHealthProbe: ptr.To(false),
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.Equal(t, *orig.Spec.ForProvider.Config.HealthProbe.PeriodSeconds, *updated.Spec.ForProvider.Config.HealthProbe.PeriodSeconds)
-				assert.Equal(t, orig.Spec.ForProvider.Config.HealthProbe.HTTPGet.Path, updated.Spec.ForProvider.Config.HealthProbe.HTTPGet.Path)
+				is := require.New(t)
+				is.Equal(*orig.Spec.ForProvider.Config.HealthProbe.PeriodSeconds, *updated.Spec.ForProvider.Config.HealthProbe.PeriodSeconds)
+				is.Equal(orig.Spec.ForProvider.Config.HealthProbe.HTTPGet.Path, updated.Spec.ForProvider.Config.HealthProbe.HTTPGet.Path)
 			},
 		},
 		"reset env variable": {
@@ -215,14 +219,15 @@ func TestApplication(t *testing.T) {
 				DeleteEnv: &[]string{"foo"},
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
+				is := require.New(t)
 				foundFoo := false
 				for _, env := range updated.Spec.ForProvider.Config.Env {
 					if env.Name == "foo" {
 						foundFoo = true
 					}
 				}
-				assert.False(t, foundFoo)
-				assert.NotEmpty(t, updated.Spec.ForProvider.BuildEnv)
+				is.False(foundFoo)
+				is.NotEmpty(updated.Spec.ForProvider.BuildEnv)
 			},
 		},
 		"change multiple env variables at once": {
@@ -234,9 +239,10 @@ func TestApplication(t *testing.T) {
 				Env: map[string]string{"bar1": "zoo", "bar2": "foo"},
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.Contains(t, updated.Spec.ForProvider.Config.Env, apps.EnvVar{Name: "bar1", Value: "zoo"})
-				assert.Contains(t, updated.Spec.ForProvider.Config.Env, apps.EnvVar{Name: "bar2", Value: "foo"})
-				assert.Contains(t, updated.Spec.ForProvider.Config.Env, apps.EnvVar{Name: "foo", Value: "bar"})
+				is := require.New(t)
+				is.Contains(updated.Spec.ForProvider.Config.Env, apps.EnvVar{Name: "bar1", Value: "zoo"})
+				is.Contains(updated.Spec.ForProvider.Config.Env, apps.EnvVar{Name: "bar2", Value: "foo"})
+				is.Contains(updated.Spec.ForProvider.Config.Env, apps.EnvVar{Name: "foo", Value: "bar"})
 			},
 		},
 		"reset build env variable": {
@@ -248,8 +254,9 @@ func TestApplication(t *testing.T) {
 				DeleteBuildEnv: &[]string{"BP_ENVIRONMENT_VARIABLE"},
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.Empty(t, updated.Spec.ForProvider.BuildEnv)
-				assert.NotEmpty(t, updated.Spec.ForProvider.Config.Env)
+				is := require.New(t)
+				is.Empty(updated.Spec.ForProvider.BuildEnv)
+				is.NotEmpty(updated.Spec.ForProvider.Config.Env)
 			},
 		},
 		"update variable from normal/sensitive": {
@@ -261,10 +268,11 @@ func TestApplication(t *testing.T) {
 				SensitiveEnv: map[string]string{"poo": "blue"},
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
+				is := require.New(t)
 				sensitivePoo := util.EnvVarByName(updated.Spec.ForProvider.Config.Env, "poo")
-				require.NotNil(t, sensitivePoo)
-				require.NotNil(t, sensitivePoo.Sensitive)
-				assert.True(t, *sensitivePoo.Sensitive)
+				is.NotNil(sensitivePoo)
+				is.NotNil(sensitivePoo.Sensitive)
+				is.True(*sensitivePoo.Sensitive)
 			},
 		},
 
@@ -277,7 +285,8 @@ func TestApplication(t *testing.T) {
 				ChangeBasicAuthPassword: ptr.To(true),
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.NotNil(t, updated.Spec.ForProvider.BasicAuthPasswordChange)
+				is := require.New(t)
+				is.NotNil(updated.Spec.ForProvider.BasicAuthPasswordChange)
 			},
 		},
 		"git auth update user/pass": {
@@ -309,9 +318,10 @@ func TestApplication(t *testing.T) {
 				},
 			},
 			checkSecret: func(t *testing.T, cmd applicationCmd, authSecret *corev1.Secret) {
-				assert.Equal(t, *cmd.Git.Username, string(authSecret.Data[util.UsernameSecretKey]))
-				assert.Equal(t, *cmd.Git.Password, string(authSecret.Data[util.PasswordSecretKey]))
-				assert.Equal(t, authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
+				is := require.New(t)
+				is.Equal(*cmd.Git.Username, string(authSecret.Data[util.UsernameSecretKey]))
+				is.Equal(*cmd.Git.Password, string(authSecret.Data[util.PasswordSecretKey]))
+				is.Equal(authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
 			},
 		},
 		"git auth update ssh key": {
@@ -341,8 +351,9 @@ func TestApplication(t *testing.T) {
 				},
 			},
 			checkSecret: func(t *testing.T, cmd applicationCmd, authSecret *corev1.Secret) {
-				assert.Equal(t, strings.TrimSpace(*cmd.Git.SSHPrivateKey), string(authSecret.Data[util.PrivateKeySecretKey]))
-				assert.Equal(t, authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
+				is := require.New(t)
+				is.Equal(strings.TrimSpace(*cmd.Git.SSHPrivateKey), string(authSecret.Data[util.PrivateKeySecretKey]))
+				is.Equal(authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
 			},
 		},
 		"git auth update creates a secret": {
@@ -371,9 +382,10 @@ func TestApplication(t *testing.T) {
 				},
 			},
 			checkSecret: func(t *testing.T, cmd applicationCmd, authSecret *corev1.Secret) {
-				assert.Equal(t, *cmd.Git.Username, string(authSecret.Data[util.UsernameSecretKey]))
-				assert.Equal(t, *cmd.Git.Password, string(authSecret.Data[util.PasswordSecretKey]))
-				assert.Equal(t, authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
+				is := require.New(t)
+				is.Equal(*cmd.Git.Username, string(authSecret.Data[util.UsernameSecretKey]))
+				is.Equal(*cmd.Git.Password, string(authSecret.Data[util.PasswordSecretKey]))
+				is.Equal(authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
 			},
 		},
 		"git auth is unchanged on normal field update": {
@@ -403,11 +415,13 @@ func TestApplication(t *testing.T) {
 				},
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.Equal(t, *cmd.Git.URL, updated.Spec.ForProvider.Git.URL)
+				is := require.New(t)
+				is.Equal(*cmd.Git.URL, updated.Spec.ForProvider.Git.URL)
 			},
 			checkSecret: func(t *testing.T, cmd applicationCmd, authSecret *corev1.Secret) {
-				assert.Equal(t, "fakekey", string(authSecret.Data[util.PrivateKeySecretKey]))
-				assert.Equal(t, authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
+				is := require.New(t)
+				is.Equal("fakekey", string(authSecret.Data[util.PrivateKeySecretKey]))
+				is.Equal(authSecret.Annotations[util.ManagedByAnnotation], util.NctlName)
 			},
 		},
 		"disable deploy job": {
@@ -438,7 +452,8 @@ func TestApplication(t *testing.T) {
 				},
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.Nil(t, updated.Spec.ForProvider.Config.DeployJob)
+				is := require.New(t)
+				is.Nil(updated.Spec.ForProvider.Config.DeployJob)
 			},
 		},
 		"retry release": {
@@ -450,7 +465,8 @@ func TestApplication(t *testing.T) {
 				RetryRelease: ptr.To(true),
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.NotNil(t, util.EnvVarByName(updated.Spec.ForProvider.Config.Env, ReleaseTrigger))
+				is := require.New(t)
+				is.NotNil(util.EnvVarByName(updated.Spec.ForProvider.Config.Env, ReleaseTrigger))
 			},
 		},
 		"do not retry release": {
@@ -462,7 +478,8 @@ func TestApplication(t *testing.T) {
 				RetryRelease: ptr.To(false),
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.Nil(t, util.EnvVarByName(updated.Spec.ForProvider.Config.Env, ReleaseTrigger))
+				is := require.New(t)
+				is.Nil(util.EnvVarByName(updated.Spec.ForProvider.Config.Env, ReleaseTrigger))
 			},
 		},
 		"retry build": {
@@ -474,7 +491,8 @@ func TestApplication(t *testing.T) {
 				RetryBuild: ptr.To(true),
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.NotNil(t, util.EnvVarByName(updated.Spec.ForProvider.BuildEnv, BuildTrigger))
+				is := require.New(t)
+				is.NotNil(util.EnvVarByName(updated.Spec.ForProvider.BuildEnv, BuildTrigger))
 			},
 		},
 		"do not retry build": {
@@ -486,7 +504,8 @@ func TestApplication(t *testing.T) {
 				RetryBuild: ptr.To(false),
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.Nil(t, util.EnvVarByName(updated.Spec.ForProvider.BuildEnv, BuildTrigger))
+				is := require.New(t)
+				is.Nil(util.EnvVarByName(updated.Spec.ForProvider.BuildEnv, BuildTrigger))
 			},
 		},
 		"disabling the git repo check works": {
@@ -507,7 +526,8 @@ func TestApplication(t *testing.T) {
 				},
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.Equal(t, *cmd.Git.URL, updated.Spec.ForProvider.Git.URL)
+				is := require.New(t)
+				is.Equal(*cmd.Git.URL, updated.Spec.ForProvider.Git.URL)
 			},
 		},
 		"an error on the git repo check will lead to an error shown to the user": {
@@ -579,14 +599,17 @@ func TestApplication(t *testing.T) {
 				},
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, orig, updated *apps.Application) {
-				assert.Equal(t, "https://github.com/ninech/new-repo", updated.Spec.ForProvider.Git.URL)
-				assert.Equal(t, "main", updated.Spec.ForProvider.Git.Revision)
+				is := require.New(t)
+				is.Equal("https://github.com/ninech/new-repo", updated.Spec.ForProvider.Git.URL)
+				is.Equal("main", updated.Spec.ForProvider.Git.Revision)
 			},
 		},
 	}
 
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
+			is := require.New(t)
+
 			if tc.cmd.GitInformationServiceURL == "" {
 				tc.cmd.GitInformationServiceURL = gitInfoService.URL()
 			}
@@ -596,21 +619,20 @@ func TestApplication(t *testing.T) {
 			if tc.gitAuth != nil {
 				objects = append(objects, tc.gitAuth.Secret(tc.orig))
 			}
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithObjects(objects...),
 			)
-			require.NoError(t, err)
 
-			if err := tc.cmd.Run(ctx, apiClient); err != nil {
+			if err := tc.cmd.Run(t.Context(), apiClient); err != nil {
 				if tc.errorExpected {
-					require.Error(t, err)
+					is.Error(err)
 				} else {
-					require.NoError(t, err)
+					is.NoError(err)
 				}
 			}
 
 			updated := &apps.Application{}
-			if err := apiClient.Get(ctx, apiClient.Name(tc.orig.Name), updated); err != nil {
+			if err := apiClient.Get(t.Context(), apiClient.Name(tc.orig.Name), updated); err != nil {
 				t.Fatal(err)
 			}
 
@@ -620,7 +642,7 @@ func TestApplication(t *testing.T) {
 
 			if tc.checkSecret != nil {
 				updatedSecret := &corev1.Secret{}
-				if err := apiClient.Get(ctx, apiClient.Name(tc.orig.Name), updatedSecret); err != nil {
+				if err := apiClient.Get(t.Context(), apiClient.Name(tc.orig.Name), updatedSecret); err != nil {
 					t.Fatal(err)
 				}
 
@@ -634,21 +656,25 @@ func TestApplication(t *testing.T) {
 // pointers. As we rely on pointers to check if a user supplied a flag we also
 // want to test it in case this ever changes in future kong versions.
 func TestApplicationFlags(t *testing.T) {
+	t.Parallel()
+
+	is := require.New(t)
+
 	nilFlags := &applicationCmd{}
 	vars, err := create.ApplicationKongVars()
-	require.NoError(t, err)
+	is.NoError(err)
 	_, err = kong.Must(nilFlags, vars, kong.BindTo(t.Output(), (*io.Writer)(nil))).Parse([]string{`testname`})
-	require.NoError(t, err)
+	is.NoError(err)
 
-	assert.Nil(t, nilFlags.Hosts)
-	assert.Nil(t, nilFlags.Env)
-	assert.Nil(t, nilFlags.BuildEnv)
+	is.Nil(nilFlags.Hosts)
+	is.Nil(nilFlags.Env)
+	is.Nil(nilFlags.BuildEnv)
 
 	emptyFlags := &applicationCmd{}
 	_, err = kong.Must(emptyFlags, vars, kong.BindTo(t.Output(), (*io.Writer)(nil))).Parse([]string{`testname`, `--hosts=""`, `--env=`, `--build-env=`})
-	require.NoError(t, err)
+	is.NoError(err)
 
-	assert.NotNil(t, emptyFlags.Hosts)
-	assert.NotNil(t, emptyFlags.Env)
-	assert.NotNil(t, emptyFlags.BuildEnv)
+	is.NotNil(emptyFlags.Hosts)
+	is.NotNil(emptyFlags.Env)
+	is.NotNil(emptyFlags.BuildEnv)
 }
diff --git a/update/bucket_test.go b/update/bucket_test.go
index cc04bb3a..f8a68a82 100644
--- a/update/bucket_test.go
+++ b/update/bucket_test.go
@@ -11,12 +11,13 @@ import (
 
 	meta "github.com/ninech/apis/meta/v1alpha1"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 func TestBucket(t *testing.T) {
+	t.Parallel()
+
 	baseBucketParameters := storage.BucketParameters{}
 	for name, tc := range map[string]struct {
 		flags           []string
@@ -693,6 +694,8 @@ func TestBucket(t *testing.T) {
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
+			is := require.New(t)
+
 			project := "proj-" + t.Name()
 			name := "bucket-" + t.Name()
 
@@ -714,21 +717,21 @@ func TestBucket(t *testing.T) {
 				test.WithObjects(orig),
 			)
 			if tc.wantErr {
-				require.Error(t, err)
+				is.Error(err)
 				return
 			}
-			require.NoError(t, err)
-			require.Equal(t, name, resolvedName)
+			is.NoError(err)
+			is.Equal(name, resolvedName)
 
 			updated := &storage.Bucket{}
-			require.NoError(t, apiClient.Get(
+			is.NoError(apiClient.Get(
 				t.Context(),
 				api.NamespacedName(resolvedName, apiClient.Project),
 				updated,
 			))
 
 			if tc.wantForProvider != nil {
-				assert.Equal(t, *tc.wantForProvider, updated.Spec.ForProvider)
+				is.Equal(*tc.wantForProvider, updated.Spec.ForProvider)
 			}
 
 			if tc.afterAssert != nil {
diff --git a/update/bucketuser_test.go b/update/bucketuser_test.go
index bc08b685..eec0b9f4 100644
--- a/update/bucketuser_test.go
+++ b/update/bucketuser_test.go
@@ -18,10 +18,7 @@ import (
 func TestBucketUser(t *testing.T) {
 	t.Parallel()
 
-	apiClient, err := test.SetupClient()
-	if err != nil {
-		t.Fatalf("setup client error, got: %s", err)
-	}
+	apiClient := test.SetupClient(t)
 
 	created := bucketUser("user", apiClient.Project, "nine-es34")
 	if err := apiClient.Create(t.Context(), created); err != nil {
diff --git a/update/cloudvm_test.go b/update/cloudvm_test.go
index a2e50b8f..7925c579 100644
--- a/update/cloudvm_test.go
+++ b/update/cloudvm_test.go
@@ -55,14 +55,13 @@ func TestCloudVM(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			out := &bytes.Buffer{}
 			tt.update.Writer = format.NewWriter(out)
 			tt.update.Name = "test-" + t.Name()
 
-			apiClient, err := test.SetupClient()
-			if err != nil {
-				t.Fatalf("setup client error, got: %s", err)
-			}
+			apiClient := test.SetupClient(t)
 
 			created := test.CloudVirtualMachine(tt.update.Name, apiClient.Project, "nine-es34", tt.create.PowerState)
 			created.Spec.ForProvider = tt.create
diff --git a/update/keyvaluestore_test.go b/update/keyvaluestore_test.go
index f6af7d91..6b9ee637 100644
--- a/update/keyvaluestore_test.go
+++ b/update/keyvaluestore_test.go
@@ -1,7 +1,6 @@
 package update
 
 import (
-	"context"
 	"testing"
 
 	meta "github.com/ninech/apis/meta/v1alpha1"
@@ -14,7 +13,8 @@ import (
 )
 
 func TestKeyValueStore(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
+
 	tests := []struct {
 		name    string
 		create  storage.KeyValueStoreParameters
@@ -122,27 +122,28 @@ func TestKeyValueStore(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			is := require.New(t)
 
 			tt.update.Name = "test-" + t.Name()
 
-			apiClient, err := test.SetupClient()
-			is.NoError(err)
+			apiClient := test.SetupClient(t)
 
 			created := test.KeyValueStore(tt.update.Name, apiClient.Project, meta.LocationNineES34)
 			created.Spec.ForProvider = tt.create
-			if err := apiClient.Create(ctx, created); err != nil {
+			if err := apiClient.Create(t.Context(), created); err != nil {
 				t.Fatalf("keyvaluestore create error, got: %s", err)
 			}
-			if err := apiClient.Get(ctx, api.ObjectName(created), created); err != nil {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), created); err != nil {
 				t.Fatalf("expected keyvaluestore to exist, got: %s", err)
 			}
 
 			updated := &storage.KeyValueStore{}
-			if err := tt.update.Run(ctx, apiClient); (err != nil) != tt.wantErr {
+			if err := tt.update.Run(t.Context(), apiClient); (err != nil) != tt.wantErr {
 				t.Errorf("keyValueStoreCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
-			if err := apiClient.Get(ctx, api.ObjectName(created), updated); err != nil {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), updated); err != nil {
 				t.Fatalf("expected keyvaluestore to exist, got: %s", err)
 			}
 
diff --git a/update/mysql_test.go b/update/mysql_test.go
index 41264762..93d1b285 100644
--- a/update/mysql_test.go
+++ b/update/mysql_test.go
@@ -1,7 +1,6 @@
 package update
 
 import (
-	"context"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -10,12 +9,12 @@ import (
 	storage "github.com/ninech/apis/storage/v1alpha1"
 	"github.com/ninech/nctl/api"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	"k8s.io/utils/ptr"
 )
 
 func TestMySQL(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
+
 	tests := []struct {
 		name    string
 		create  storage.MySQLParameters
@@ -98,25 +97,26 @@ func TestMySQL(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			tt.update.Name = "test-" + t.Name()
 
-			apiClient, err := test.SetupClient()
-			require.NoError(t, err)
+			apiClient := test.SetupClient(t)
 
 			created := test.MySQL(tt.update.Name, apiClient.Project, "nine-es34")
 			created.Spec.ForProvider = tt.create
-			if err := apiClient.Create(ctx, created); err != nil {
+			if err := apiClient.Create(t.Context(), created); err != nil {
 				t.Fatalf("mysql create error, got: %s", err)
 			}
-			if err := apiClient.Get(ctx, api.ObjectName(created), created); err != nil {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), created); err != nil {
 				t.Fatalf("expected mysql to exist, got: %s", err)
 			}
 
 			updated := &storage.MySQL{}
-			if err := tt.update.Run(ctx, apiClient); (err != nil) != tt.wantErr {
+			if err := tt.update.Run(t.Context(), apiClient); (err != nil) != tt.wantErr {
 				t.Errorf("mySQLCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
-			if err := apiClient.Get(ctx, api.ObjectName(created), updated); err != nil {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), updated); err != nil {
 				t.Fatalf("expected mysql to exist, got: %s", err)
 			}
 
diff --git a/update/mysqldatabase_test.go b/update/mysqldatabase_test.go
index 0d9eb3f3..513f2a22 100644
--- a/update/mysqldatabase_test.go
+++ b/update/mysqldatabase_test.go
@@ -39,10 +39,7 @@ func TestMySQLDatabase(t *testing.T) {
 			tt.update.Writer = format.NewWriter(out)
 			tt.update.Name = "test-" + t.Name()
 
-			apiClient, err := test.SetupClient()
-			if err != nil {
-				t.Fatalf("setup client error, got: %s", err)
-			}
+			apiClient := test.SetupClient(t)
 
 			created := test.MySQLDatabase(tt.update.Name, apiClient.Project, "nine-es34")
 			created.Spec.ForProvider = tt.create
diff --git a/update/opensearch_test.go b/update/opensearch_test.go
index caa673ae..db5e063c 100644
--- a/update/opensearch_test.go
+++ b/update/opensearch_test.go
@@ -1,7 +1,6 @@
 package update
 
 import (
-	"context"
 	"testing"
 
 	infra "github.com/ninech/apis/infrastructure/v1alpha1"
@@ -15,7 +14,8 @@ import (
 )
 
 func TestOpenSearch(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
+
 	tests := []struct {
 		name    string
 		create  storage.OpenSearchParameters
@@ -98,27 +98,28 @@ func TestOpenSearch(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			is := require.New(t)
 
 			tt.update.Name = "test-" + t.Name()
 
-			apiClient, err := test.SetupClient()
-			is.NoError(err)
+			apiClient := test.SetupClient(t)
 
 			created := test.OpenSearch(tt.update.Name, apiClient.Project, meta.LocationNineES34)
 			created.Spec.ForProvider = tt.create
-			if err := apiClient.Create(ctx, created); err != nil {
+			if err := apiClient.Create(t.Context(), created); err != nil {
 				t.Fatalf("opensearch create error, got: %s", err)
 			}
-			if err := apiClient.Get(ctx, api.ObjectName(created), created); err != nil {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), created); err != nil {
 				t.Fatalf("expected opensearch to exist, got: %s", err)
 			}
 
 			updated := &storage.OpenSearch{}
-			if err := tt.update.Run(ctx, apiClient); (err != nil) != tt.wantErr {
+			if err := tt.update.Run(t.Context(), apiClient); (err != nil) != tt.wantErr {
 				t.Errorf("openSearchCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
-			if err := apiClient.Get(ctx, api.ObjectName(created), updated); err != nil {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), updated); err != nil {
 				t.Fatalf("expected openSearch to exist, got: %s", err)
 			}
 
diff --git a/update/postgres_test.go b/update/postgres_test.go
index 7a465303..dda57f3e 100644
--- a/update/postgres_test.go
+++ b/update/postgres_test.go
@@ -1,7 +1,6 @@
 package update
 
 import (
-	"context"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -10,12 +9,12 @@ import (
 	storage "github.com/ninech/apis/storage/v1alpha1"
 	"github.com/ninech/nctl/api"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/require"
 	"k8s.io/utils/ptr"
 )
 
 func TestPostgres(t *testing.T) {
-	ctx := context.Background()
+	t.Parallel()
+
 	tests := []struct {
 		name    string
 		create  storage.PostgresParameters
@@ -78,25 +77,26 @@ func TestPostgres(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			tt.update.Name = "test-" + t.Name()
 
-			apiClient, err := test.SetupClient()
-			require.NoError(t, err)
+			apiClient := test.SetupClient(t)
 
 			created := test.Postgres(tt.update.Name, apiClient.Project, "nine-es34")
 			created.Spec.ForProvider = tt.create
-			if err := apiClient.Create(ctx, created); err != nil {
+			if err := apiClient.Create(t.Context(), created); err != nil {
 				t.Fatalf("postgres create error, got: %s", err)
 			}
-			if err := apiClient.Get(ctx, api.ObjectName(created), created); err != nil {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), created); err != nil {
 				t.Fatalf("expected postgres to exist, got: %s", err)
 			}
 
 			updated := &storage.Postgres{}
-			if err := tt.update.Run(ctx, apiClient); (err != nil) != tt.wantErr {
+			if err := tt.update.Run(t.Context(), apiClient); (err != nil) != tt.wantErr {
 				t.Errorf("postgresCmd.Run() error = %v, wantErr %v", err, tt.wantErr)
 			}
-			if err := apiClient.Get(ctx, api.ObjectName(created), updated); err != nil {
+			if err := apiClient.Get(t.Context(), api.ObjectName(created), updated); err != nil {
 				t.Fatalf("expected postgres to exist, got: %s", err)
 			}
 
diff --git a/update/postgresdatabase_test.go b/update/postgresdatabase_test.go
index c5af1732..42c2b515 100644
--- a/update/postgresdatabase_test.go
+++ b/update/postgresdatabase_test.go
@@ -39,10 +39,7 @@ func TestPostgresDatabase(t *testing.T) {
 			tt.update.Writer = format.NewWriter(out)
 			tt.update.Name = "test-" + t.Name()
 
-			apiClient, err := test.SetupClient()
-			if err != nil {
-				t.Fatalf("setup client error, got: %s", err)
-			}
+			apiClient := test.SetupClient(t)
 
 			created := test.PostgresDatabase(tt.update.Name, apiClient.Project, "nine-es34")
 			created.Spec.ForProvider = tt.create
diff --git a/update/project_config_test.go b/update/project_config_test.go
index 110adf1d..68f68562 100644
--- a/update/project_config_test.go
+++ b/update/project_config_test.go
@@ -1,7 +1,6 @@
 package update
 
 import (
-	"context"
 	"testing"
 	"time"
 
@@ -9,13 +8,14 @@ import (
 	apps "github.com/ninech/apis/apps/v1alpha1"
 	"github.com/ninech/nctl/api/util"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
 )
 
 func TestConfig(t *testing.T) {
+	t.Parallel()
+
 	const project = test.DefaultProject
 
 	initialSize := test.AppMicro
@@ -49,7 +49,8 @@ func TestConfig(t *testing.T) {
 				Port: ptr.To(int32(1234)),
 			},
 			checkConfig: func(t *testing.T, cmd configCmd, orig, updated *apps.ProjectConfig) {
-				assert.Equal(t, *cmd.Port, *updated.Spec.ForProvider.Config.Port)
+				is := require.New(t)
+				is.Equal(*cmd.Port, *updated.Spec.ForProvider.Config.Port)
 			},
 		},
 		"port is unchanged when updating unrelated field": {
@@ -58,8 +59,9 @@ func TestConfig(t *testing.T) {
 				Size: ptr.To("newsize"),
 			},
 			checkConfig: func(t *testing.T, cmd configCmd, orig, updated *apps.ProjectConfig) {
-				assert.Equal(t, *orig.Spec.ForProvider.Config.Port, *updated.Spec.ForProvider.Config.Port)
-				assert.NotEqual(t, orig.Spec.ForProvider.Config.Size, updated.Spec.ForProvider.Config.Size)
+				is := require.New(t)
+				is.Equal(*orig.Spec.ForProvider.Config.Port, *updated.Spec.ForProvider.Config.Port)
+				is.NotEqual(orig.Spec.ForProvider.Config.Size, updated.Spec.ForProvider.Config.Size)
 			},
 		},
 		"update basic auth": {
@@ -68,7 +70,8 @@ func TestConfig(t *testing.T) {
 				BasicAuth: ptr.To(true),
 			},
 			checkConfig: func(t *testing.T, cmd configCmd, orig, updated *apps.ProjectConfig) {
-				assert.True(t, *updated.Spec.ForProvider.Config.EnableBasicAuth)
+				is := require.New(t)
+				is.True(*updated.Spec.ForProvider.Config.EnableBasicAuth)
 			},
 		},
 		"all fields update": {
@@ -85,35 +88,32 @@ func TestConfig(t *testing.T) {
 				},
 			},
 			checkConfig: func(t *testing.T, cmd configCmd, orig, updated *apps.ProjectConfig) {
-				assert.Equal(t, apps.ApplicationSize(*cmd.Size), updated.Spec.ForProvider.Config.Size)
-				assert.Equal(t, *cmd.Port, *updated.Spec.ForProvider.Config.Port)
-				assert.Equal(t, *cmd.Replicas, *updated.Spec.ForProvider.Config.Replicas)
-				assert.Equal(t, *cmd.BasicAuth, *updated.Spec.ForProvider.Config.EnableBasicAuth)
-				assert.Equal(t, util.EnvVarsFromMap(cmd.Env), updated.Spec.ForProvider.Config.Env)
-				assert.Equal(t, *cmd.DeployJob.Command, updated.Spec.ForProvider.Config.DeployJob.Command)
-				assert.Equal(t, *cmd.DeployJob.Name, updated.Spec.ForProvider.Config.DeployJob.Name)
-				assert.Equal(t, *cmd.DeployJob.Timeout, updated.Spec.ForProvider.Config.DeployJob.Timeout.Duration)
-				assert.Equal(t, *cmd.DeployJob.Retries, *updated.Spec.ForProvider.Config.DeployJob.Retries)
+				is := require.New(t)
+				is.Equal(apps.ApplicationSize(*cmd.Size), updated.Spec.ForProvider.Config.Size)
+				is.Equal(*cmd.Port, *updated.Spec.ForProvider.Config.Port)
+				is.Equal(*cmd.Replicas, *updated.Spec.ForProvider.Config.Replicas)
+				is.Equal(*cmd.BasicAuth, *updated.Spec.ForProvider.Config.EnableBasicAuth)
+				is.Equal(util.EnvVarsFromMap(cmd.Env), updated.Spec.ForProvider.Config.Env)
+				is.Equal(*cmd.DeployJob.Command, updated.Spec.ForProvider.Config.DeployJob.Command)
+				is.Equal(*cmd.DeployJob.Name, updated.Spec.ForProvider.Config.DeployJob.Name)
+				is.Equal(*cmd.DeployJob.Timeout, updated.Spec.ForProvider.Config.DeployJob.Timeout.Duration)
+				is.Equal(*cmd.DeployJob.Retries, *updated.Spec.ForProvider.Config.DeployJob.Retries)
 			},
 		},
 	}
 
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithObjects(tc.orig),
 			)
-			if err != nil {
-				t.Fatal(err)
-			}
 
-			ctx := context.Background()
-			if err := tc.cmd.Run(ctx, apiClient); err != nil {
+			if err := tc.cmd.Run(t.Context(), apiClient); err != nil {
 				t.Fatal(err)
 			}
 
 			updated := &apps.ProjectConfig{}
-			if err := apiClient.Get(ctx, apiClient.Name(tc.orig.Name), updated); err != nil {
+			if err := apiClient.Get(t.Context(), apiClient.Name(tc.orig.Name), updated); err != nil {
 				t.Fatal(err)
 			}
 
@@ -128,18 +128,22 @@ func TestConfig(t *testing.T) {
 // pointers. As we rely on pointers to check if a user supplied a flag we also
 // want to test it in case this ever changes in future kong versions.
 func TestProjectConfigFlags(t *testing.T) {
+	t.Parallel()
+
+	is := require.New(t)
+
 	type cmd struct {
 		Env map[string]string `help:"Environment variables which are passed to the app at runtime."`
 	}
 	nilFlags := &cmd{}
 	_, err := kong.Must(nilFlags).Parse([]string{})
-	require.NoError(t, err)
+	is.NoError(err)
 
-	assert.Nil(t, nilFlags.Env)
+	is.Nil(nilFlags.Env)
 
 	emptyFlags := &cmd{}
 	_, err = kong.Must(emptyFlags).Parse([]string{`--env=`})
-	require.NoError(t, err)
+	is.NoError(err)
 
-	assert.NotNil(t, emptyFlags.Env)
+	is.NotNil(emptyFlags.Env)
 }
diff --git a/update/project_test.go b/update/project_test.go
index 77fa422d..cf1ca320 100644
--- a/update/project_test.go
+++ b/update/project_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/ninech/nctl/api"
 	"github.com/ninech/nctl/internal/format"
 	"github.com/ninech/nctl/internal/test"
-	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
 )
@@ -41,27 +41,23 @@ func TestProject(t *testing.T) {
 				DisplayName: ptr.To("some display name"),
 			},
 			checkProject: func(t *testing.T, cmd projectCmd, orig, updated *management.Project) {
-				assert.Equal(t, *cmd.DisplayName, updated.Spec.DisplayName)
+				is := require.New(t)
+				is.Equal(*cmd.DisplayName, updated.Spec.DisplayName)
 			},
 		},
 	}
 
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
 			out := &bytes.Buffer{}
 			tc.cmd.Writer = format.NewWriter(out)
 
-			apiClient, err := test.SetupClient(
+			apiClient := test.SetupClient(t,
 				test.WithObjects(tc.orig),
 				test.WithOrganization(organization),
 				test.WithDefaultProject(tc.orig.Name),
-				test.WithKubeconfig(t),
+				test.WithKubeconfig(),
 			)
-			if err != nil {
-				t.Fatal(err)
-			}
 
 			if err := tc.cmd.Run(t.Context(), apiClient); err != nil {
 				t.Fatal(err)
diff --git a/update/serviceconnection_test.go b/update/serviceconnection_test.go
index 18d50650..b64d6f36 100644
--- a/update/serviceconnection_test.go
+++ b/update/serviceconnection_test.go
@@ -136,10 +136,7 @@ func TestServiceConnection(t *testing.T) {
 			tt.update.Writer = format.NewWriter(out)
 			tt.update.Name = "test-" + t.Name()
 
-			apiClient, err := test.SetupClient()
-			if err != nil {
-				t.Fatalf("setup client error, got: %s", err)
-			}
+			apiClient := test.SetupClient(t)
 
 			created := test.ServiceConnection(tt.update.Name, apiClient.Project)
 			if err := apiClient.Create(t.Context(), created); err != nil {