# Pod fixtures for the label + host-namespace policies. Pods (not Deployments) are
# used so `kyverno test` result rows reference the base rule names directly; the
# same rules reach Deployment/StatefulSet pod templates via pod-controller autogen
# in CI and in-cluster.
#
# ---- COMPLIANT ----
apiVersion: v1
kind: Pod
metadata:
  name: good-workload
  namespace: app-ns
  labels:
    homelab.keithjackson.dev/egress-class: internet
    homelab.keithjackson.dev/auth-mode: oidc
spec:
  containers:
    - name: app
      image: registry.example/app:1.0.0
---
# ---- egress-class violations (R-NET-05) ----
apiVersion: v1
kind: Pod
metadata:
  name: bad-egress-missing        # no egress-class label at all
  namespace: app-ns
  labels:
    homelab.keithjackson.dev/auth-mode: oidc
spec:
  containers:
    - name: app
      image: registry.example/app:1.0.0
---
apiVersion: v1
kind: Pod
metadata:
  name: bad-egress-invalid        # egress-class not in {internet,vpn}
  namespace: app-ns
  labels:
    homelab.keithjackson.dev/egress-class: wan
    homelab.keithjackson.dev/auth-mode: oidc
spec:
  containers:
    - name: app
      image: registry.example/app:1.0.0
---
# ---- auth-mode violations (R-IDP-02) ----
apiVersion: v1
kind: Pod
metadata:
  name: bad-auth-missing          # no auth-mode label
  namespace: app-ns
  labels:
    homelab.keithjackson.dev/egress-class: vpn
spec:
  containers:
    - name: app
      image: registry.example/app:1.0.0
---
apiVersion: v1
kind: Pod
metadata:
  name: bad-auth-invalid          # auth-mode not in the enum
  namespace: app-ns
  labels:
    homelab.keithjackson.dev/egress-class: vpn
    homelab.keithjackson.dev/auth-mode: basic
spec:
  containers:
    - name: app
      image: registry.example/app:1.0.0
---
# ---- host-namespace / privilege violations (R-SEC-02) ----
apiVersion: v1
kind: Pod
metadata:
  name: bad-hostnetwork           # hostNetwork bypasses default-deny
  namespace: app-ns
  labels:
    homelab.keithjackson.dev/egress-class: internet
    homelab.keithjackson.dev/auth-mode: none
spec:
  hostNetwork: true
  containers:
    - name: app
      image: registry.example/app:1.0.0
---
apiVersion: v1
kind: Pod
metadata:
  name: bad-privileged            # privileged container
  namespace: app-ns
  labels:
    homelab.keithjackson.dev/egress-class: internet
    homelab.keithjackson.dev/auth-mode: none
spec:
  containers:
    - name: app
      image: registry.example/app:1.0.0
      securityContext:
        privileged: true
---
# ---- scope proof: same bare pod in a NON-app namespace must be SKIPPED ----
apiVersion: v1
kind: Pod
metadata:
  name: platform-workload
  namespace: platform-ns
spec:
  hostNetwork: true               # allowed here: platform ns is out of scope
  containers:
    - name: agent
      image: registry.example/agent:1.0.0