# Values for `kyverno test` -- supplies the Namespace LABELS the offline CLI needs to
# resolve `namespaceSelector` matches (R-SEC-02/R-NET-05/R-IDP-02 policies scope by the
# app-namespace label). Without this the engine cannot see a Namespace's labels for a
# Pod under test, so every namespaceSelector rule is silently EXCLUDED and the pass/fail
# assertions below become vacuous. These labels mirror resources/namespaces.yaml so the
# app-namespace pods are genuinely evaluated and the platform-namespace pod is genuinely
# out of scope (skip).
apiVersion: cli.kyverno.io/v1alpha1
kind: Values
metadata:
  name: values
namespaceSelector:
  - name: app-ns
    labels:
      homelab.keithjackson.dev/app-namespace: "true"
  - name: platform-ns
    labels:
      kubernetes.io/metadata.name: platform-ns