---
# vuln-scanner — the CVE visibility scanner (R-VULN-01..09, ADR-0027, docs/17). Hand-authored platform
# delivery tooling, not a catalog service: its cluster-wide read identity is something a
# ServiceDefinition cannot express.
#
# gateway-access=shared opts this namespace in to attach the cve.<domain> HTTPRoute to the shared
# Gateway; the route targets the per-pod oauth2-proxy sidecar (:4180), never the page directly.
#
# INTENTIONALLY NOT homelab.keithjackson.dev/app-namespace=true (the crafty/cloudflared/pm-agent
# posture): every Kyverno app policy matches on that label, and the generated default-deny would then
# be double-owned with the one this tree ships (networkpolicy.yaml), the 2026-09-30 drift loop. The
# pod still carries the egress-class and auth-mode labels those policies would require.
#
# PodSecurity `restricted` IS enforced: nothing here needs any privilege.
apiVersion: v1
kind: Namespace
metadata:
  name: vuln-scanner
  labels:
    app.kubernetes.io/name: vuln-scanner
    gateway-access: "shared"
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest