# Platform label/annotation convention (RATIFIED)

These label keys are consumed by the Kyverno policies in this directory. The **values**
are fixed by the spec; the **keys** are the platform convention, now **ratified in the
spec** — `homelab.keithjackson.dev/{egress-class,auth-mode,app-namespace,baseline}` are
documented in `docs/03-networking-isolation-and-egress.md` ("Platform label-key
convention") as the contract that network policies, Kyverno rules, and renderers key off.
Shared contract with WS-NET (egress rendering), WS-SEC (auth), and WS-GITOPS (rendering).

| Label key | Applied to | Values | Fixed by | Used by policy |
|---|---|---|---|---|
| `homelab.keithjackson.dev/app-namespace` | Namespace | `"true"` | (convention) marks an application namespace / trust zone (docs/03) | all namespace-scoped policies |
| `homelab.keithjackson.dev/egress-class` | Pod (+ controller template) | `internet` \| `vpn` | docs/03, docs/13 | `require-egress-class-label` (R-NET-05); also the selector Cilium Egress Gateway steers on (ADR-0013) |
| `homelab.keithjackson.dev/auth-mode` | Pod (+ controller template) | `oidc` \| `forward-auth` \| `native` \| `none` | docs/13, docs/15 | `require-auth-mode-label` (R-IDP-02) |
| `homelab.keithjackson.dev/baseline` | NetworkPolicy | `default-deny` | (convention) identifies the baseline NP | `require-default-deny-baseline` (generate), `validate-default-deny-shape` |
| `homelab.keithjackson.dev/secret-managed-by` | Secret | `controller` | (convention) exempts controller-generated Secrets | `disallow-plaintext-secrets` (exclude), admission `secret-provenance` |

## Rendering expectation (for WS-GITOPS)

The ServiceDefinition (`docs/13`) declares intent — `egress:` and `auth.mode:` — at the
service level. The renderer (T-0.3 / T-2.3 / T-6.1d) is expected to project those onto
the **pod template labels** above so that (a) Cilium selects pods by `egress-class` and
(b) these admission policies pass. Application namespaces are expected to be created
carrying `app-namespace: "true"` so the baseline is generated and the label/host
policies apply.

[`agents/coordination-protocol.md` §2]: ../../../home-network-k3s/agents/coordination-protocol.md