---
# vpn-egress — the VPN egress namespace (ADR-0015, docs/03).
# Under ADR-0015 there is NO privileged in-cluster gateway pod: the tunnel is a node-level host
# OpenVPN service (Ansible role vpn_egress_gateway). This namespace now holds only the
# CiliumEgressGatewayPolicy (egress-steering.yaml) plus the retained, now-unused pia-* secrets.
# Platform INFRA, not an application namespace, so it is deliberately NOT labeled `app-namespace=true`
# (Kyverno restrict-host-namespaces / require-*-label policies scope to app namespaces only — see
# platform/kyverno).
apiVersion: v1
kind: Namespace
metadata:
  name: vpn-egress
  labels:
    homelab.keithjackson.dev/app-namespace: "false"