---
# Crafty Controller — Minecraft server management panel (Java + Bedrock). Its web UI is served at
# crafty.home.keithjackson.dev via the shared Gateway, GATED by a per-pod oauth2-proxy sidecar in
# reverse-proxy mode (Keycloak `homelab` realm, group `platform-admins`) — the decided Option-B auth
# pattern (platform/oauth2-proxy/README.md: Cilium 1.16.5 cannot do ext_authz on the shared Gateway).
#
# gateway-access=shared opts this namespace in to attach HTTPRoutes to the shared Gateway (the
# *.home.keithjackson.dev wildcard cert already covers crafty.home). The Gateway routes to the
# oauth2-proxy sidecar (:4180), never directly to Crafty's UI.
#
# NOTE: intentionally NOT homelab.keithjackson.dev/app-namespace=true. Crafty is a PLATFORM admin tool
# (like Headlamp in `headlamp` / Homepage in `homepage`), so Kyverno does NOT generate the app
# default-deny baseline here and the app-scoped auth-mode / egress-class / host-namespace policies do
# not apply (all Kyverno policies match namespaceSelector app-namespace=true). We still ship an
# explicit default-deny NetworkPolicy + CiliumNetworkPolicies (networkpolicy.yaml) as defense in depth.
apiVersion: v1
kind: Namespace
metadata:
  name: crafty
  labels:
    gateway-access: "shared"