apiVersion: v1
kind: Namespace
metadata:
  name: kyverno
  labels:
    # Platform namespace -- deliberately NOT an application namespace, so the
    # app-scoped policies do not apply to Kyverno's own workloads.
    homelab.keithjackson.dev/app-namespace: "false"
    pod-security.kubernetes.io/enforce: restricted