---
id: w7/m4/t005
title: Test coverage — meaningful tests for the extended egress policy generation
worker: worker7
status: done
estimate: 30m
depends_on: [w7/m4/t003]
---

## Objective

Add meaningful tests asserting the generated tenant NetworkPolicy egress now excepts the link-local range (and, if the node-path deny is operator-emitted, that it is generated). Tests must assert real behavior and failure modes — not snapshot the whole policy.

## Context

- `lego/operator/internal/controller/isolation_test.go` — the existing home for tenant-isolation policy assertions (m1). Extend it.
- Assert on the egress rule's `IPBlock.Except` containing `169.254.0.0/16` alongside the RFC1918/CGNAT ranges; assert a policy is still generated only for workspace-labeled Apps (unchanged m1 invariant).

## Steps

1. Extend `isolation_test.go` with a case asserting `169.254.0.0/16` is in the public-internet egress `Except` list.
2. If t002 emits a policy from the operator, assert its presence/shape; if it's a static gitops manifest, note that it's covered by the t003 live probe instead (no unit surface).
3. `cd lego/operator && go test ./internal/controller/...`.

## Files

- `lego/operator/internal/controller/isolation_test.go`

## Acceptance criteria

- [ ] A test fails if `169.254.0.0/16` is dropped from the egress `Except` list.
- [ ] Existing m1 isolation tests still pass; no tautological/snapshot-everything tests added.

## Out of scope

- Live cluster probing (t003 covers that).
