feat(irc): add Istio ambient mode, waypoint, and AuthorizationPolicies

- Add namespace.yaml with istio ambient + waypoint labels
- Add waypoint Gateway (istio-waypoint) scoped to irc namespace
- Switch thelounge HTTPRoute from Cilium external to istio-external gateway
- Add AuthorizationPolicy for thelounge (allow inbound from gateway-system only)
- Add AuthorizationPolicy for znc (allow all on port 6501 for IRC clients)
- Add namespace: irc to root kustomization, remove dependency on targetNamespace

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

kustomization.yaml

@@ -1,6 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+
+namespace: irc
+
 resources:
+  - namespace.yaml
+  - waypoint.yaml
 # Uncomment if storing configuration in the repo
 # - configmap.yaml
   - ./thelounge

namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: irc
+  labels:
+    istio.io/dataplane-mode: ambient
+    istio.io/use-waypoint: waypoint

thelounge/authorizationpolicy.yaml

@@ -0,0 +1,16 @@
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: thelounge
+  namespace: irc
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: thelounge
+  action: ALLOW
+  rules:
+  - from:
+    - source:
+        namespaces:
+        - gateway-system

thelounge/httproute.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: irc
 spec:
   parentRefs:
-    - name: external
+    - name: istio-external
       namespace: gateway-system
   hostnames:
     - ${THELOUNGE_HOSTNAME}

thelounge/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - statefulset.yaml
   - service.yaml
   - httproute.yaml
+  - authorizationpolicy.yaml

waypoint.yaml

@@ -0,0 +1,13 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: irc
+  labels:
+    istio.io/waypoint-for: namespace
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+  - name: mesh
+    port: 15008
+    protocol: HBONE

znc/authorizationpolicy.yaml

@@ -0,0 +1,16 @@
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: znc
+  namespace: irc
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: znc
+  action: ALLOW
+  rules:
+  - to:
+    - operation:
+        ports:
+        - "6501"

znc/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - statefulset.yaml
   - service.yaml
+  - authorizationpolicy.yaml