feat(irc): restrict ingress to gateway and thelounge

Add CiliumNetworkPolicy ingress rules so thelounge only accepts traffic
from the cilium external gateway in gateway-system, and znc only from
the thelounge pod. Allow host entity on both for kubelet probes.

Switch znc service to ClusterIP and drop the external-dns annotation
since direct external IRC client access is no longer desired.

thelounge/ciliumnetworkpolicy.yaml

@@ -1,12 +1,27 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
-  name: thelounge-egress
+  name: thelounge
   namespace: irc
 spec:
   endpointSelector:
     matchLabels:
       app.kubernetes.io/name: thelounge
+  ingress:
+  - fromEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: gateway-system
+        k8s:gateway.networking.k8s.io/gateway-name: external
+    toPorts:
+    - ports:
+      - port: "9000"
+        protocol: TCP
+  - fromEntities:
+    - host
+    toPorts:
+    - ports:
+      - port: "9000"
+        protocol: TCP
   egress:
   - toEndpoints:
     - matchLabels:

znc/ciliumnetworkpolicy.yaml

@@ -1,12 +1,27 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
-  name: znc-egress
+  name: znc
   namespace: irc
 spec:
   endpointSelector:
     matchLabels:
       app.kubernetes.io/name: znc
+  ingress:
+  - fromEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: irc
+        k8s:app.kubernetes.io/name: thelounge
+    toPorts:
+    - ports:
+      - port: "6501"
+        protocol: TCP
+  - fromEntities:
+    - host
+    toPorts:
+    - ports:
+      - port: "6501"
+        protocol: TCP
   egress:
   - toEndpoints:
     - matchLabels:

znc/service.yaml

@@ -6,10 +6,8 @@ metadata:
   name: znc
   labels:
     app.kubernetes.io/name: znc
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: ${ZNC_HOSTNAME}
 spec:
-  type: LoadBalancer
+  type: ClusterIP
   ports:
     - port: 6501
   selector: