---
apiVersion: v1
kind: Namespace
metadata:
  name: runbooks
  labels:
    # Serve the runbooks at https://<apex>/runbooks/<name> — the APEX host, on a `/runbooks` path
    # prefix. The apex has its own `https-apex` listener on the shared Gateway
    # (platform/gateway/gateway.yaml); this label opts the namespace in to attach HTTPRoutes to it
    # (serving/httproute.yaml). Same opt-in as homepage, which owns the apex `/` prefix.
    gateway-access: "shared"
    # NOT homelab.keithjackson.dev/app-namespace=true. This is a PLATFORM component (like homepage and
    # headlamp), so Kyverno does not generate the app default-deny baseline here and the app-scoped
    # auth-mode / egress-class policies do not apply. The default-deny NetworkPolicy and the
    # Gateway-only CiliumNetworkPolicy are shipped explicitly in serving/networkpolicy.yaml instead.
    app.kubernetes.io/name: runbooks