15 lines
772 B
YAML
15 lines
772 B
YAML
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: keycloak
|
|
labels:
|
|
# Opt this namespace's HTTPRoute in to the shared Gateway (docs/09). Keycloak is served at
|
|
# keycloak.home.keithjackson.dev, TLS terminated by the Gateway's wildcard cert.
|
|
gateway-access: "shared"
|
|
# NOTE: intentionally NOT homelab.keithjackson.dev/app-namespace=true — Keycloak/CNPG are
|
|
# PLATFORM components (like monitoring/longhorn), so Kyverno does not generate the app default-deny
|
|
# baseline here and the auth-mode/host-namespace app policies do not apply (they scope to
|
|
# app-namespaces). Keycloak is still an ordinary workload under Cilium's cluster-wide posture
|
|
# (docs/15); the app->Keycloak / proxy->Keycloak / Keycloak->DB flows are the explicit allows.
|