WIP keycloak stack (gate probe)

platform/keycloak/namespace.yaml

@@ -3,3 +3,12 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: keycloak
+  labels:
+    # Opt this namespace's HTTPRoute in to the shared Gateway (docs/09). Keycloak is served at
+    # keycloak.home.keithjackson.dev, TLS terminated by the Gateway's wildcard cert.
+    gateway-access: "shared"
+    # NOTE: intentionally NOT homelab.keithjackson.dev/app-namespace=true — Keycloak/CNPG are
+    # PLATFORM components (like monitoring/longhorn), so Kyverno does not generate the app default-deny
+    # baseline here and the auth-mode/host-namespace app policies do not apply (they scope to
+    # app-namespaces). Keycloak is still an ordinary workload under Cilium's cluster-wide posture
+    # (docs/15); the app->Keycloak / proxy->Keycloak / Keycloak->DB flows are the explicit allows.