---
# kured — namespace for the Kubernetes Reboot Daemon DaemonSet.
#
# PLATFORM INFRA, NOT AN APPLICATION NAMESPACE, and here that distinction is the difference between
# a working component and an admission rejection. kured runs `hostPID: true` with a `privileged: true`
# container (it `nsenter`s /proc/1/ns/mnt to run `/bin/systemctl reboot` on the host). Both are
# forbidden by platform/kyverno/policies/restrict-host-namespaces.yaml — but that policy, like every
# other policy in this repo, is scoped by
#   `namespaceSelector: matchLabels: homelab.keithjackson.dev/app-namespace: "true"`
# and its own header states the carve-out: "platform components that do [need these] live in platform
# namespaces that do NOT carry the app-namespace label, so they are out of scope."
# Verified by reading the policies on this branch, not assumed:
#   * restrict-host-namespaces.yaml rule `disallow-host-namespaces`     (hostPID)
#   * restrict-host-namespaces.yaml rule `disallow-privileged-containers` (privileged)
#
# We set the label EXPLICITLY to "false" rather than leaving it unset, following
# platform/intel-gpu-plugin/namespace.yaml and platform/vpn-egress: an unset label and a deliberate
# "false" are identical to the admission engine but not to a reviewer, and this component's
# correctness depends entirely on the answer.
#
# NO PodSecurity labels. There is no cluster-wide PSA baseline in this repo — `pod-security.*`
# appears only where a namespace opts IN (conformance/incluster, platform/kyverno/admission,
# platform/pm-agent), all at `enforce: restricted`. Adding them here would reject this DaemonSet for
# the same reasons Kyverno would. Leaving them off is the convention for a privileged platform
# namespace (platform/vpn-ingress/namespace.yaml sets none either).
#
# NO `gateway-access` label. kured serves no HTTP to users and attaches no HTTPRoute; its only
# listener is the :8080 metrics endpoint, reached in-cluster by Prometheus. See networkpolicy.yaml.
apiVersion: v1
kind: Namespace
metadata:
  name: kured
  labels:
    homelab.keithjackson.dev/app-namespace: "false"