# Serves: R-IDP-02 (every service authenticates against the IdP; no unauthenticated UI)
# Spec: docs/15-identity-and-access.md; docs/13 `auth.mode: oidc|forward-auth|native|none`.
#
# Every workload must declare which authentication mode it uses so the platform can
# wire the correct integration (native OIDC Keycloak client, oauth2-proxy forward-auth
# at the Gateway, a documented `native` exception e.g. Plex, or `none`). A missing
# auth declaration would let a bare management UI onto the network unprotected, which
# docs/15 forbids ("no management UI sits unauthenticated").
#
# Matches Pods; pod-controller autogen extends to Deployment/StatefulSet/etc.
# LABEL KEY is a PROPOSED contract owned jointly with WS-SEC/WS-GITOPS -- see
# platform/kyverno/labels.md. The VALUES are fixed by docs/13.
# NOTE: `none` is permitted by the enum (docs/13) but is "discouraged / internal-only";
# the ServiceDefinition-level policy additionally forbids `public` + `none`.
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-auth-mode-label
  annotations:
    policies.kyverno.io/title: Require auth-mode label on workloads
    policies.kyverno.io/category: Identity
    policies.kyverno.io/severity: medium
    homelab.keithjackson.dev/requirements: R-IDP-02
    policies.kyverno.io/description: >-
      Pods in application namespaces must declare
      homelab.keithjackson.dev/auth-mode = oidc | forward-auth | native | none.
spec:
  validationFailureAction: ${KYVERNO_VALIDATION_ACTION}
  background: true
  rules:
    - name: require-auth-mode
      match:
        any:
          - resources:
              kinds:
                - Pod
              namespaceSelector:
                matchLabels:
                  homelab.keithjackson.dev/app-namespace: "true"
      validate:
        message: >-
          Pods in application namespaces must carry the label
          homelab.keithjackson.dev/auth-mode set to one of
          oidc | forward-auth | native | none (R-IDP-02, docs/15).
        pattern:
          metadata:
            labels:
              homelab.keithjackson.dev/auth-mode: "oidc | forward-auth | native | none"