feat(irc): migrate from Cilium to Istio AuthorizationPolicies

Replace CiliumNetworkPolicies with Istio AuthorizationPolicies, point
the thelounge HTTPRoute at the istio-external gateway, and give each
workload a dedicated ServiceAccount for precise mTLS identity.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

thelounge/authorizationpolicy.yaml

@@ -0,0 +1,15 @@
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: thelounge
+  namespace: irc
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: thelounge
+  action: ALLOW
+  rules:
+    - from:
+        - source:
+            principals:
+              - cluster.local/ns/gateway-system/sa/istio-external-istio

thelounge/ciliumnetworkpolicy.yaml

@@ -1,52 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: thelounge
-  namespace: irc
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: thelounge
-  ingress:
-  - fromEntities:
-    - ingress
-    - host
-    toPorts:
-    - ports:
-      - port: "9000"
-        protocol: TCP
-  egress:
-  - toEndpoints:
-    - matchLabels:
-        k8s:io.kubernetes.pod.namespace: kube-system
-        k8s:k8s-app: kube-dns
-    toPorts:
-    - ports:
-      - port: "53"
-        protocol: ANY
-      rules:
-        dns:
-        - matchPattern: "*"
-  - toEndpoints:
-    - matchLabels:
-        k8s:io.kubernetes.pod.namespace: auth
-        k8s:app.kubernetes.io/name: authentik-outpost-ldap
-        k8s:goauthentik.io/outpost-type: ldap
-    toPorts:
-    - ports:
-      - port: "389"
-        protocol: TCP
-  - toEndpoints:
-    - matchLabels:
-        k8s:io.kubernetes.pod.namespace: irc
-        k8s:app.kubernetes.io/name: znc
-    toPorts:
-    - ports:
-      - port: "6501"
-        protocol: TCP
-  - toFQDNs:
-    - matchName: "irc.passthepopcorn.me"
-    toPorts:
-    - ports:
-      - port: "6697"
-        protocol: TCP

thelounge/httproute.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: irc
 spec:
   parentRefs:
-    - name: external
+    - name: istio-external
       namespace: gateway-system
   hostnames:
     - ${THELOUNGE_HOSTNAME}

thelounge/kustomization.yaml

@@ -1,8 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - serviceaccount.yaml
   - statefulset.yaml
   - service.yaml
   - httproute.yaml
-  - ciliumnetworkpolicy.yaml
+  - authorizationpolicy.yaml
   - config.yaml

thelounge/serviceaccount.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: thelounge
+  namespace: irc
+automountServiceAccountToken: false

thelounge/statefulset.yaml

@@ -21,6 +21,7 @@ spec:
         app.kubernetes.io/instance: thelounge
     spec:
       priorityClassName: low-priority
+      serviceAccountName: thelounge
       automountServiceAccountToken: false
       securityContext:
         runAsNonRoot: true

znc/authorizationpolicy.yaml

@@ -0,0 +1,15 @@
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: znc
+  namespace: irc
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: znc
+  action: ALLOW
+  rules:
+    - from:
+        - source:
+            principals:
+              - cluster.local/ns/irc/sa/thelounge

znc/ciliumnetworkpolicy.yaml

@@ -1,42 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: znc
-  namespace: irc
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: znc
-  ingress:
-  - fromEndpoints:
-    - matchLabels:
-        k8s:io.kubernetes.pod.namespace: irc
-        k8s:app.kubernetes.io/name: thelounge
-    toPorts:
-    - ports:
-      - port: "6501"
-        protocol: TCP
-  - fromEntities:
-    - host
-    toPorts:
-    - ports:
-      - port: "6501"
-        protocol: TCP
-  egress:
-  - toEndpoints:
-    - matchLabels:
-        k8s:io.kubernetes.pod.namespace: kube-system
-        k8s:k8s-app: kube-dns
-    toPorts:
-    - ports:
-      - port: "53"
-        protocol: ANY
-      rules:
-        dns:
-        - matchPattern: "*"
-  - toFQDNs:
-    - matchName: "irc.passthepopcorn.me"
-    toPorts:
-    - ports:
-      - port: "6697"
-        protocol: TCP

znc/kustomization.yaml

@@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - serviceaccount.yaml
   - statefulset.yaml
   - service.yaml
-  - ciliumnetworkpolicy.yaml
+  - authorizationpolicy.yaml

znc/serviceaccount.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: znc
+  namespace: irc
+automountServiceAccountToken: false

znc/statefulset.yaml

@@ -30,6 +30,7 @@ spec:
         app.kubernetes.io/instance: znc
     spec:
       priorityClassName: low-priority
+      serviceAccountName: znc
       automountServiceAccountToken: false
       containers:
         - name: znc