Namespace layout

The cluster's namespace layout by tier, as kernel/namespaces.yaml declares it: the one list the installer creates from, the operator selects on and the lints check against.

1. kernel

Name	function	holds
kernel-gitops	gitops	Argo CD, argocd-image-updater
kernel-provisioning	provisioning	Crossplane, its providers and functions
kernel-secrets	secrets	OpenBao, External Secrets Operator, Reloader
kernel-seal	seal	the OpenBao transit seal; a separate RBAC and backup domain from the vault it unseals
kernel-data	data	the CNPG operator and kernel-postgres (Keycloak, its extensions, OpenFGA, the console)
kernel-authentication	authentication	Keycloak, its configuration, the event listener
kernel-authorization	authorization	OpenFGA; reachable from enforcement points only
kernel-control	control	the operator, the director, the usher, the custodian, the registrar
kernel-edge	edge	Envoy Gateway, both Gateway objects, cert-manager, external-dns, cloudflared
kernel-admission	admission	Kyverno and the baseline policies; node-apparmor, which keeps containerd's AppArmor profile from blocking signals inside a container
kernel-observability	observability	Headlamp (the cluster administrator's view of the cluster, with their own identity); the platform's monitoring and log forwarder when switched on

2. system

Name	function	holds	when
system-postgresql	postgresql	the CNPG cluster tenant databases are provisioned on; the kernel's own is kernel-postgres, in kernel-data
system-mariadb	mariadb	MariaDB, for catalog apps that speak no other engine
system-cache	cache	Redis
system-s3	s3	SeaweedFS, the object store apps take buckets from
system-authorization	authorization	the app instance of OpenFGA, with the components' authorization stores, and the arbiter, the one way into it	requires.services.authorization
system-turn-dmz	turn-dmz	the TURN edge — STUNner's daemon, its load balancer, its certificate and the record of turn.<kernel domain>; it relays only to its own pods	requires.services.turn
system-mail	mail	Postfix (the MTA and the DKIM signer, with the per-tenant keys) and Dovecot (the mailbox store); nothing here has a load balancer	mail.serviceMode=system
system-mail-dmz	mail-dmz	the mail edge — a proxy on :25, :587 and :993 that holds no mail, no user and no key — its load balancer, and the DNS records that point at it	mail.serviceMode=system
system-llm	llm	the LiteLLM proxy, its database, and the vLLM instances the claim lists	llm.enabled=true

3. labelled

Name	tier	function
kube-system	kernel	platform
metallb-system	kernel	load-balancer