---
# UniFi (KubeVirt VM) namespace. Reconciled by the NON-GATING `apps-vms` Flux Kustomization
# (clusters/base/apps-vms.yaml, wait:false) — VMs are a separate lifecycle from the rendered
# container-app waves, and UniFi has no in-cluster dependents, so a slow VM import/install can't
# stall the app tier.
#
# Namespace (trust zone). Carries the app-namespace label (Kyverno require-auth-mode-label
# + default-deny apply here) and gateway-access=shared so an OPTIONAL HTTPRoute could
# attach to the shared Gateway (see 90-httproute-optional.yaml). backup-policy matches the
# vm-demo/pihole convention so the VM's Longhorn disk is captured off-cluster.
apiVersion: v1
kind: Namespace
metadata:
  name: unifi
  labels:
    homelab.keithjackson.dev/app-namespace: 'true'
    gateway-access: shared
  annotations:
    homelab.keithjackson.dev/backup-policy: daily-offcluster