---
# intel-gpu-plugin — namespace for the Intel GPU device plugin DaemonSet.
#
# PLATFORM INFRA, NOT AN APPLICATION NAMESPACE, and that distinction is load-bearing here rather
# than cosmetic. Every Kyverno policy that could object to this DaemonSet is scoped by a
# `namespaceSelector: matchLabels: homelab.keithjackson.dev/app-namespace: "true"` — verified by
# reading the policies, not assumed:
#   * platform/kyverno/policies/restrict-host-namespaces.yaml  (hostNetwork/PID/IPC + privileged)
#   * platform/kyverno/policies/require-egress-class-label.yaml
#   * platform/kyverno/policies/require-auth-mode-label.yaml
#   * platform/kyverno/policies/require-default-deny-baseline.yaml (a *generate* rule, so an
#     app-namespace also gets a default-deny NetworkPolicy minted into it)
# Labelling this namespace "false" therefore puts it out of scope for all four. That is the same
# mechanism restrict-host-namespaces' own header describes: "platform components that do [need host
# access] live in platform namespaces that do NOT carry the app-namespace label".
#
# Measured on prod 2026-10-01: `kyverno` and `vpn-egress` are the two namespaces that carry the
# label explicitly as "false"; the rest of the platform namespaces leave it unset. Both are out of
# scope identically — an unset label does not match `"true"`. We set it EXPLICITLY, following
# vpn-egress, because "someone chose this" and "nobody thought about it" should not look the same
# in git, and because this component's correctness depends on the answer.
#
# NOTE this plugin does NOT actually need any of the things those policies forbid: it sets no
# hostNetwork/hostPID/hostIPC and is not privileged (see intel-gpu-plugin.yaml). The namespace
# placement is not a workaround for a policy — there is nothing to work around. It is here because
# a node-level platform DaemonSet is not an application, and because the app-namespace fabric
# (default-deny NetworkPolicy, egress-class, auth-mode) describes obligations that are meaningless
# for a process that talks only to the local kubelet over a unix socket and never uses the network.
apiVersion: v1
kind: Namespace
metadata:
  name: intel-gpu-plugin
  labels:
    homelab.keithjackson.dev/app-namespace: "false"