---
# Cloudflare Tunnel connector (north-south INGRESS from the Cloudflare edge). See README.md.
#
# NOT homelab.keithjackson.dev/app-namespace=true. This is platform network infrastructure (like
# vpn-ingress / vpn-egress), not an application, so Kyverno's app-scoped policies — including the
# `require-default-deny-baseline` GENERATE rule — do not select this namespace. That is why
# networkpolicy.yaml ships its own `default-deny` here, and why doing so creates NO second owner
# of that object: Kyverno never generates one in a namespace without the app-namespace label
# (the drift loop recorded in the 2026-09-30 handoff only exists where both write the same name).
#
# NO `gateway-access` label. Nothing here attaches an HTTPRoute to the shared Gateway; cloudflared
# is a CLIENT of the Gateway, not a backend behind it.
apiVersion: v1
kind: Namespace
metadata:
  name: cloudflared
  labels:
    app.kubernetes.io/name: cloudflared