# Serves: R-NET-05 (egress is a declared property; every workload declares its class)
# Spec: docs/03 "Egress is a declared property"; docs/13 `egress: internet | vpn`.
#
# The egress class is enforced OUTSIDE the service (Cilium Egress Gateway selects
# pods by label -> steers `vpn` pods through the shared PIA/Gluetun gateway, ADR-0013).
# For that steering to be possible the label MUST exist on the pod and be one of the
# two valid classes. A missing/typo'd class would silently fall back to the plain
# internet path -- a fail-OPEN egress leak -- so we require it explicitly (fail-closed
# posture, coordination-protocol.md #8).
#
# Matches Pods; pod-controller autogen extends to Deployment/StatefulSet/etc.
# LABEL KEY is a PROPOSED contract owned jointly with WS-NET/WS-GITOPS -- see
# platform/kyverno/labels.md and the report's escalation note. The VALUES
# (internet|vpn) are fixed by docs/03 + docs/13.
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-egress-class-label
  annotations:
    policies.kyverno.io/title: Require egress-class label on workloads
    policies.kyverno.io/category: Network Isolation
    policies.kyverno.io/severity: high
    homelab.keithjackson.dev/requirements: R-NET-05
    policies.kyverno.io/description: >-
      Pods in application namespaces must declare
      homelab.keithjackson.dev/egress-class = internet | vpn.
spec:
  validationFailureAction: ${KYVERNO_VALIDATION_ACTION}
  background: true
  rules:
    - name: require-egress-class
      match:
        any:
          - resources:
              kinds:
                - Pod
              namespaceSelector:
                matchLabels:
                  homelab.keithjackson.dev/app-namespace: "true"
      validate:
        message: >-
          Pods in application namespaces must carry the label
          homelab.keithjackson.dev/egress-class set to 'internet' or 'vpn' (R-NET-05,
          docs/03).
        pattern:
          metadata:
            labels:
              homelab.keithjackson.dev/egress-class: "internet | vpn"