---
id: w7/m1/t005
title: "Verification script: cross-tenant + platform reachability matrix"
worker: worker7
status: done
estimate: 45m
depends_on: [w7/m1/t003, w7/m1/t004]
---

## Objective

A scriptable reachability matrix that proves the milestone's DoD: from a tenant pod, cross-workspace and tenant→platform probes are blocked while own-workspace, Traefik ingress, and internet egress work — exit 0 when compliant, non-zero naming the first probe that unexpectedly succeeds or fails.

## Context

- Follows the `scripts/` helper pattern (`scripts/app-apply.sh`, `scripts/deploy-sample.sh`); runs against the current kubeconfig (mock cluster or prod).
- Needs apps in two distinct workspaces to be meaningful — real multi-workspace data arrives with w1/m9; until then the script sets up two Apps with distinct workspace labels itself.
- Probes: `kubectl exec` + `curl`/`nc` from a tenant pod against another workspace's pod IP, its CNPG/Valkey Service DNS, `bex-api.bex-system:8091`, OpenBao `:8200`, Prometheus, zot; positive probes for own-datastore, same-workspace private service, own public URL, and `https://example.com`.

## Steps

1. Write `scripts/verify-tenant-isolation.sh`: deploy (or reuse) two labelled test Apps + a probe pod per workspace, run the matrix, tear down.
2. Record the matrix as a table in `docs/ADR022-tenant-isolation.md` so the script and the ADR agree.
3. Run it on the mock cluster with t003+t004 applied; fix policy gaps it finds.

## Files

- `scripts/verify-tenant-isolation.sh` (new)
- `docs/ADR022-tenant-isolation.md` (matrix table)

## Acceptance criteria

- [ ] Script exits 0 on a policy-compliant cluster and non-zero (naming the probe) when any deny-probe unexpectedly connects
- [ ] Positive probes pass: own datastore, same-workspace private service, Traefik URL, public internet
- [ ] Documented matrix matches the script's probe list

## Out of scope

- CI wiring (candidate follow-up note once the mock cluster runs in CI)
