---
# vpn-egress — the single shared VPN egress gateway namespace (ADR-0013, docs/03).
# Platform INFRA, not an application namespace: the Gluetun gateway needs NET_ADMIN + /dev/net/tun,
# so this ns is deliberately NOT labeled `app-namespace=true` (Kyverno restrict-host-namespaces /
# require-*-label policies scope to app namespaces only — see platform/kyverno).
apiVersion: v1
kind: Namespace
metadata:
  name: vpn-egress
  labels:
    homelab.keithjackson.dev/app-namespace: "false"