---
id: w7/m4/t003
title: Extend verify-tenant-isolation.sh with DENY probes for metadata + node IP
worker: worker7
status: done
estimate: 30m
depends_on: [w7/m4/t002]
---

## Objective

Make the closure provable and regression-proof: add DENY probes to the isolation verification script so that "metadata and node-local endpoints are unreachable from tenant pods" is asserted the same way the existing allow/deny matrix is, and the script fails if either hole reopens.

## Context

- `scripts/verify-tenant-isolation.sh` — the m1 matrix runner. It already has `probe_allow` (e.g. `internet-egress` → `https://example.com`, same-workspace private service) and `probe_deny` helpers across two workspaces `tea-verify-a…`/`tea-verify-b…`, exit 0 on full pass.
- New DENY targets: `http://169.254.169.254/` (cloud metadata) and a node public IP on `:10250` / a nodePort.

## Steps

1. Add a `probe_deny "metadata-egress" probe-a "http://169.254.169.254/hetzner/v1/metadata"` (short curl timeout; must fail/timeout).
2. Add a `probe_deny` for a node public IP:port (`:10250` and/or a nodePort — discover the node IP via `kubectl get node -o wide` in-script).
3. Keep the existing `internet-egress` ALLOW probe as the counter-assertion (external egress still works).
4. Update the script's header comment block listing what it proves.

## Files

- `scripts/verify-tenant-isolation.sh`

## Acceptance criteria

- [ ] The script includes DENY probes for `169.254.169.254` and a node public IP:port, and an ALLOW probe for genuine external egress.
- [ ] On a cluster with t001+t002 applied, the script exits 0; reverting either change makes it exit non-zero (the probe catches the regression).

## Out of scope

- The policy changes themselves (t001, t002).
- Unit-test-level policy assertions (t005).
