---
apiVersion: v1
kind: Namespace
metadata:
  name: oauth2-proxy
  labels:
    # Opt in to the shared Gateway so oauth2-proxy's sign-in/callback endpoint is reachable at
    # auth.home.keithjackson.dev (docs/09). Platform component — NOT app-namespace (see keycloak ns note).
    gateway-access: "shared"