---
id: w6/m6/t004
title: Network policy conformance test — live verification
worker: worker6
status: done
estimate: 45m
depends_on: []
---

## Objective

Live-verify that `docs/ADR022-tenant-isolation.md`'s reachability matrix actually holds on a running cluster, not just as a declared table.

## Context

- `docs/ADR022-tenant-isolation.md` documents the threat model and expected reachability matrix (tenant↔tenant, tenant↔platform, tenant↔control-plane) but has no live test backing it.
- Mock cluster available via `bash scripts/mock-cluster.sh`.

## Steps

1. Stand up (or use an existing) mock cluster with representative tenant/platform workloads.
2. For each cell in the reachability matrix, run an actual connection attempt (e.g. `kubectl exec` + `curl`/`nc` between pods) and record pass/fail against the documented expectation.
3. Fix any NetworkPolicy gaps discovered.
4. Turn the test into a repeatable script (feeds t009's test-coverage task).

## Files

- `docs/ADR022-tenant-isolation.md`
- NetworkPolicy manifests (`deploy/gitops/**`, `lego/operator/**` if operator-managed)

## Acceptance criteria

- [ ] Every cell of the reachability matrix has a live pass/fail result.
- [ ] Any discovered gap is fixed or filed as a follow-up with justification.
- [ ] The test is scripted and repeatable, not one-off manual commands.

## Out of scope

- Extending the threat model itself (this task verifies the existing model, doesn't redesign it).
