On this page
Topic - Network addressing policy test matrix
Overview
Minimum addressing policy tests required before promotion.
Context
This matrix turns addressing policy into repeatable gates. It is the canonical test set referenced by network-addressing-guardrails and change evidence bundles.
Applicable Principles
- Automation First - policy checks run in CI before deployment.
- Security by Design - route and tenancy boundaries are validated as controls.
- Observability by Default - every gate emits auditable artifacts.
Decisions
- All in-scope addressing changes use this matrix as baseline gate set.
- Failed critical tests block promotion until corrected or approved through exception governance.
- Test results are stored with parser and command-profile metadata.
- Tests anchored to adr-023-ipv6-numberplan-and-cluster-scale-strategy are interim working-direction gates while ADR-023 remains draft.
Current State
Baseline tests and required evidence
| Test ID | Policy anchor | Pass criteria | Evidence artifact | Owner | Frequency | Severity |
|---|---|---|---|---|---|---|
ADDR-001 | network-addressing-guardrails overlap prohibition | No duplicate prefix in unauthorized shared VRF | Route-policy parse report plus VRF route snapshot | Network Architecture | Every change | Blocker |
ADDR-002 | network-addressing-guardrails boundary-only overlap access | Overlap traffic exits only via approved boundary endpoint | Flow verification record and boundary policy proof | Network + Security | Every exception change | Blocker |
ADDR-003 | openshift-evpn-production-target-baseline NAT posture | No unintended node-level NAT on routed defaults | Source-identity check and conntrack impact record | Platform + Network | Every change | Blocker |
ADDR-004 | adr-023-ipv6-numberplan-and-cluster-scale-strategy (draft working direction) profile model | Requested profile fits approved pool with growth buffer | Capacity calculation report | Network Architecture | Every profile-affecting change | Blocker |
ADDR-005 | adr-023-ipv6-numberplan-and-cluster-scale-strategy (draft working direction) category usage | NC1 and NC2 mappings are correct; NC3 and NC5 usage follows policy | Category assignment check | Network Architecture | Government-facing change | Major |
ADDR-006 | topic-network-ip-addressing-scale-and-vrf-model support envelope | Capacity math includes product support reference and owner sign-off | Change record review | Network Architecture | High-density request | Major |
Future Work
- Add machine-readable policy IDs in NetBox so each change auto-selects expected tests.
- Add failover-path variants for overlap exception flows.
- Add stale-exception detection based on expiry metadata from network-addressing-guardrails.