apiVersion: v1
kind: Namespace
metadata:
  name: vnc-ca
  labels:
    # The CA is deliberately in its own namespace, NOT in `vncmail`. The webmail
    # pod is internet-facing; the CA signs certificates. A compromise of the
    # former must not be a compromise of the latter, and namespace-scoped RBAC
    # plus the NetworkPolicy in networkpolicy.yaml are what enforce that.
    app.kubernetes.io/name: vnc-ca
    app.kubernetes.io/part-of: vncmail-plus