On this page
Summary
Operational addressing guardrails for network and OpenShift changes. This note is a review contract: default behavior, prohibited behavior, and exception evidence requirements.
Applicable Principles
- Automation First - allocation and policy checks are enforced in CI.
- Reliability and Resilience - routing behavior must stay deterministic during failure and growth.
- Security by Design - tenant isolation and exception paths are explicit.
Architecture
Guardrail matrix (default/prohibited/exception plus evidence)
| Control area | Default | Prohibited | Exception path | Minimum evidence | Owner | Max validity | Revalidation trigger |
|---|---|---|---|---|---|---|---|
| Routed tenant addressing | Unique prefixes per routed VRF scope (CUDN default) | Overlapping prefixes leaked into shared routed domains | Overlap only in isolated VRFs with no direct cross-tenant routing | Duplicate-prefix leak negative test and approved boundary design | Network Architecture | 180 days | Any new shared dependency or route-policy change |
| Shared services with overlap | Shared dependency behind controlled endpoint | Direct route-leak between overlapping tenant domains | Boundary endpoint with explicit translation or proxy policy | Flow test proving boundary-only access and source-identity impact note | Network + Security Architecture | 180 days | Any endpoint policy change or tenant scope change |
| IPv4 routed scale | Transitional use for bounded scope | New large routed pod domains without approval | Time-bound exception with migration path to IPv6 profile | Capacity sheet, product support reference, migration milestone | Network Architecture | 90 days | Any pod-density increase request |
| IPv6 cluster profile | Approved profile set (/56, /54, /53) | Ad-hoc profile sizing outside approved profiles | New profile by ADR review; while ADR-023 is draft this remains working direction | NetBox profile update, CI pass, route-policy regression pass | Network Architecture | Until ADR update | Prefix model or allocator logic change |
| Government category mapping | NC1 internet and NC2 Diginetwerk mappings are mandatory where applicable | Treating NC3 or NC5 as equivalent mandatory classes | NC3 only under additional agreement; NC5 for internal-use recommendation | Category assignment proof, RPKI or reverse-DNS ownership where internet-facing | Network Architecture | 365 days | Category policy or connectivity scope change |
Decisions
- This matrix is mandatory for in-scope change review and exception approval.
- Detailed tests are owned by topic-network-addressing-policy-test-matrix.
- Policy authority for phase baseline remains adr-007-ip-addressing-2026.
- Forward IPv6 profile direction follows adr-023-ipv6-numberplan-and-cluster-scale-strategy as working direction while ADR-023 is draft.
Open Questions
- Which exception classes require Platform Architecture co-sign in addition to Network Architecture?
- Should high-risk overlap exceptions be capped at 90 days instead of 180 days?