home-network-k3s-impl/platform/kyverno/labels.md

Platform label/annotation convention (PROPOSED contract)

These label keys are consumed by the Kyverno policies in this directory. The values are fixed by the spec; the keys are a convention this workstream (WS-TEST) proposes and are a shared contract with WS-NET (network/egress rendering), WS-SEC (auth), and WS-GITOPS (ServiceDefinition → manifest rendering). Per agents/coordination-protocol.md §2 a contract like this needs the owning roles' sign-off before it is locked. Escalated as an open question in the T-0.5 report.

Label key	Applied to	Values	Fixed by	Used by policy
homelab.keithjackson.dev/app-namespace	Namespace	"true"	(convention) marks an application namespace / trust zone (docs/03)	all namespace-scoped policies
homelab.keithjackson.dev/egress-class	Pod (+ controller template)	internet | vpn	docs/03, docs/13	require-egress-class-label (R-NET-05); also the selector Cilium Egress Gateway steers on (ADR-0013)
homelab.keithjackson.dev/auth-mode	Pod (+ controller template)	oidc | forward-auth | native | none	docs/13, docs/15	require-auth-mode-label (R-IDP-02)
homelab.keithjackson.dev/baseline	NetworkPolicy	default-deny	(convention) identifies the baseline NP	require-default-deny-baseline (generate), validate-default-deny-shape
homelab.keithjackson.dev/secret-managed-by	Secret	controller	(convention) exempts controller-generated Secrets	disallow-plaintext-secrets (exclude), admission secret-provenance

Rendering expectation (for WS-GITOPS)

The ServiceDefinition (docs/13) declares intent — egress: and auth.mode: — at the service level. The renderer (T-0.3 / T-2.3 / T-6.1d) is expected to project those onto the pod template labels above so that (a) Cilium selects pods by egress-class and (b) these admission policies pass. Application namespaces are expected to be created carrying app-namespace: "true" so the baseline is generated and the label/host policies apply.