internal/

Package auth provides constant-time verification and FIPS-CSPRNG generation of the shared internal bearer token used between the admission webhook, policy-manager, and dashboard.

Package cryptofips provides a startup self-test that verifies the process is running with the Go FIPS 140-3 cryptographic module active when FIPS mode is required (CRY-WU-02).

Package middleware provides shared gin middleware for the kube-policies HTTP servers.

Package tlsreload serves a TLS server certificate that can be rotated on disk without restarting the process (CRY-WU-10).