---
# WireGuard REMOTE-ACCESS VPN (north-south INGRESS) — the counterpart to platform/vpn-egress.
#
# Do not confuse the two. They are opposite directions and share nothing but the word "VPN":
#   * platform/vpn-egress  — pods OUT to the internet through a PIA tunnel (ADR-0015, R-NET-05/06/07).
#   * platform/vpn-ingress — remote CLIENTS IN from the internet to this LAN. THIS directory.
#
# NOTE: intentionally NOT homelab.keithjackson.dev/app-namespace=true. This is PLATFORM network
# infrastructure (like cilium / vpn-egress), not an application, so Kyverno does NOT generate the app
# default-deny baseline here and the app-scoped auth-mode / egress-class / host-namespace policies do
# not apply — every Kyverno policy in platform/kyverno/policies matches namespaceSelector
# app-namespace=true. THAT EXEMPTION IS LOAD-BEARING HERE, not incidental: this workload runs with
# `hostNetwork: true`, which `restrict-host-namespaces` forbids in an app namespace. It is permitted
# here by that policy's OWN stated carve-out — "platform components that do [need host namespaces] --
# e.g. Cilium, node-exporter -- live in platform namespaces that do NOT carry the app-namespace
# label, so they are out of scope". daemonset.yaml documents why hostNetwork is REQUIRED rather than
# convenient; it is the single most consequential decision in this component.
#
# NO `gateway-access` label. This component serves no HTTP and attaches no HTTPRoute to the shared
# Gateway — it is a raw UDP listener. There is deliberately nothing here for the L7 Gateway to route.
apiVersion: v1
kind: Namespace
metadata:
  name: vpn-ingress
  labels:
    app.kubernetes.io/name: vpn-ingress