---
apiVersion: v1
kind: Namespace
metadata:
  name: keycloak
  labels:
    # Opt this namespace's HTTPRoute in to the shared Gateway (docs/09). Keycloak is served at
    # keycloak.home.keithjackson.dev, TLS terminated by the Gateway's wildcard cert.
    gateway-access: "shared"
    # NOTE: intentionally NOT homelab.keithjackson.dev/app-namespace=true — Keycloak/CNPG are
    # PLATFORM components (like monitoring/longhorn), so Kyverno does not generate the app default-deny
    # baseline here and the auth-mode/host-namespace app policies do not apply (they scope to
    # app-namespaces). Keycloak is still an ordinary workload under Cilium's cluster-wide posture
    # (docs/15); the app->Keycloak / proxy->Keycloak / Keycloak->DB flows are the explicit allows.