---
id: network-policy-off
name: "Capability: no NetworkPolicy when disabled (OFF)"
description: >-
  Renders the product chart with networkPolicy.enabled=false (or unset)
  and asserts zero NetworkPolicy documents in the render. Since the chart
  has no NetworkPolicy template at all, no NetworkPolicy objects are ever
  emitted regardless of the networkPolicy.enabled value. This scenario is
  EXPECTED to PASS — confirming no NetworkPolicy leakage when the knob
  is off.
labels: {customer: enterprise, profile: compliance}
cluster:
  provider: kind
  k8s_version: v1.36.1
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    networkPolicy.enabled: false
asserts:
  - type: network-policy
    namespace: sample
    source: rendered
    expect_present: false
tags: [capability, compliance]
category: capability
capability: network-policy
tier: capability
mechanisms: ["capability:network-policy"]