# The `agents` namespace is shared by three agents from three repos.
# Applied once, by hand, and deliberately NOT in this repo's Kustomization
# inventory: a namespace owned by one repo's self-managing Kustomization gets
# deleted — and every other agent in it with it — the moment that repo renames
# its Kustomization or GitRepository, which prunes the old one. Learned the hard
# way on 2026-08-31.
#
# kubectl apply -f k8s/namespace.yaml   # once, before anything else
# One namespace for the whole agent estate rather than one per agent. The agents
# share nothing but a trust boundary — no data, no storage, no service mesh
# policy — and splitting them would multiply the CA ConfigMap and the
# ExternalSecret without isolating anything that matters. What isolates them is
# their Keycloak client and the audiences it may request, not the namespace.
apiVersion: v1
kind: Namespace
metadata:
  name: agents