---
apiVersion: v1
kind: Namespace
metadata:
  name: headlamp
  labels:
    # Expose Headlamp at headlamp.home.keithjackson.dev via the shared Gateway (docs/09). The
    # *.home.keithjackson.dev wildcard cert already covers this host (httproute.yaml).
    gateway-access: "shared"
    # NOTE: intentionally NOT homelab.keithjackson.dev/app-namespace=true. Headlamp is a PLATFORM
    # admin tool (like Grafana in `monitoring`), so Kyverno does not generate the app default-deny
    # baseline here and the app-scoped auth-mode / egress-class / host-namespace policies do not
    # apply. We still ship an explicit default-deny NetworkPolicy + CiliumNetworkPolicies
    # (networkpolicy.yaml) as defense-in-depth: this pod holds the kube-apiserver egress path, so it
    # is locked down to exactly DNS + apiserver + Keycloak (via the Gateway VIP) egress and
    # Gateway-only ingress.