{{- if .Values.mgmtVcluster.enabled -}}
{{- /*
Fail-fast on empty image tag — even though the upstream subchart
renders the actual StatefulSet, we validate ours at the umbrella
layer because per-Sovereign overlay paths may override
.Values.mgmtVcluster.image.tag without touching the subchart values.
The helper aborts render with the canonical "image.tag is empty"
message per docs/INVIOLABLE-PRINCIPLES.md #4a (SHA-pinned images).
*/}}
{{- $_ := include "bp-mgmt-vcluster.image" . -}}
# Host namespace the MGMT vCluster lives in.
# Per docs/SOVEREIGN-MULTI-REGION-DOD.md A4: the primary region's host
# k3s runs MGMT + DMZ vClusters; each lives in its own dedicated
# namespace so the host-level NetworkPolicy/CiliumNetworkPolicy can
# default-deny + selectively allow cross-vCluster intra-region traffic.
#
# Label `catalyst.openova.io/vcluster-role` is consumed by the
# OpenovaFlow canvas adapter (products/openova-flow/adapter-flux) which
# emits a vCluster FlowNode per namespace bearing this label — the
# vCluster X/Y count on the Sovereign Console canvas reads off these
# labels per region.
apiVersion: v1
kind: Namespace
metadata:
  name: {{ include "bp-mgmt-vcluster.hostNamespace" . }}
  labels:
    {{- include "bp-mgmt-vcluster.labels" . | nindent 4 }}
    catalyst.openova.io/vcluster-role: mgmt
    catalyst.openova.io/topology: dod-a4
    # pod-security: baseline — the upstream loft-sh/vcluster 0.20.0
    # StatefulSet runs init containers (vcluster-copy) and a syncer
    # container that need elevated permissions vs `restricted`
    # (writes to a volume, no seccompProfile pinned at pod spec level,
    # runAsUser=0 in the syncer). Caught on t128 (2026-05-16): mgmt
    # ns at `restricted` blocked Pod creation:
    #   "violates PodSecurity restricted:latest: allowPrivilegeEscalation
    #    != false, unrestricted capabilities, runAsNonRoot != true,
    #    runAsUser=0 (syncer), seccompProfile (vcluster-copy, kube-*-manager,
    #    syncer)"
    # DMZ + RTZ already ship `baseline` and their Pods are Running.
    # MGMT lives on the primary's host k3s + accepts the same baseline
    # Risk envelope as DMZ/RTZ (the in-vCluster workloads run inside a
    # nested kubelet, not host PIDs).
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/audit: baseline
    pod-security.kubernetes.io/warn: baseline
{{- end }}
