Chris Farhood
060ac76748
feat(irc): migrate from Cilium to Istio AuthorizationPolicies
...
Best Practices / Kube-score Analysis (push) Failing after 6s
Security Scan / Trivy PR Review (push) Has been skipped
Best Practices / Polaris PR Review (push) Has been skipped
Security Scan / Checkov PR Review (push) Has been skipped
Validate Manifests / YAML Lint (push) Successful in 4s
Validate Manifests / Kustomize Build Test (push) Successful in 3s
Security Scan / Trivy Security Scan (push) Successful in 12s
Best Practices / Polaris Audit (push) Failing after 9s
Best Practices / Resource Usage Analysis (push) Successful in 5s
Best Practices / PR Summary Report (push) Has been skipped
Validate Manifests / Kubernetes Schema Validation (push) Successful in 6s
Security Scan / Checkov IaC Scan (push) Failing after 52s
Replace CiliumNetworkPolicies with Istio AuthorizationPolicies, point
the thelounge HTTPRoute at the istio-external gateway, and give each
workload a dedicated ServiceAccount for precise mTLS identity.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-22 11:31:28 -04:00
Chris Farhood
ee93aca3b8
fix(irc): remove namespace from istio ambient mode
...
Best Practices / Kube-score Analysis (push) Has been cancelled
Best Practices / Polaris Audit (push) Has been cancelled
Best Practices / Resource Usage Analysis (push) Has been cancelled
Best Practices / PR Summary Report (push) Has been cancelled
Best Practices / Polaris PR Review (push) Has been cancelled
Security Scan / Trivy Security Scan (push) Has been cancelled
Security Scan / Trivy PR Review (push) Has been cancelled
Security Scan / Checkov IaC Scan (push) Has been cancelled
Security Scan / Checkov PR Review (push) Has been cancelled
Validate Manifests / YAML Lint (push) Has been cancelled
Validate Manifests / Kustomize Build Test (push) Has been cancelled
Validate Manifests / Kubernetes Schema Validation (push) Has been cancelled
Drop the istio.io/dataplane-mode label and the AuthorizationPolicies
for thelounge and znc. Gateway was returning upstream connect errors
when traffic transited ztunnel; reverting the namespace to non-mesh
restores reachability. CiliumNetworkPolicies remain for egress filtering.
2026-05-17 08:13:26 -04:00
Chris Farhood
84ee1fa8b8
refactor: drop istio mesh egress, use cilium FQDN for znc egress filtering
...
Best Practices / Kube-score Analysis (push) Has been cancelled
Best Practices / Polaris Audit (push) Has been cancelled
Best Practices / Resource Usage Analysis (push) Has been cancelled
Best Practices / PR Summary Report (push) Has been cancelled
Best Practices / Polaris PR Review (push) Has been cancelled
Security Scan / Trivy Security Scan (push) Has been cancelled
Security Scan / Trivy PR Review (push) Has been cancelled
Security Scan / Checkov IaC Scan (push) Has been cancelled
Security Scan / Checkov PR Review (push) Has been cancelled
Validate Manifests / Kustomize Build Test (push) Has been cancelled
Validate Manifests / Kubernetes Schema Validation (push) Has been cancelled
Validate Manifests / YAML Lint (push) Has been cancelled
Istio ambient cannot do hostname-based egress filtering without L7
processing (waypoint/sidecar). Cilium FQDN CiliumNetworkPolicy is the
right tool — DNS-aware L3/L4 enforcement.
- Remove waypoint deployment and namespace/service label references
- Move TheLounge HTTPRoute back to Cilium external gateway
- Add CiliumNetworkPolicy for znc: allow DNS + irc.passthepopcorn.me:6697
- Remove orphaned znc/egress.yaml (Istio VirtualService routing)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-16 18:03:11 -04:00
Chris Farhood
87c03682c4
feat(irc): add Istio ambient mode, waypoint, and AuthorizationPolicies
...
Best Practices / Polaris Audit (push) Has been cancelled
Best Practices / Resource Usage Analysis (push) Has been cancelled
Best Practices / PR Summary Report (push) Has been cancelled
Best Practices / Polaris PR Review (push) Has been cancelled
Security Scan / Trivy Security Scan (push) Has been cancelled
Security Scan / Trivy PR Review (push) Has been cancelled
Security Scan / Checkov IaC Scan (push) Has been cancelled
Security Scan / Checkov PR Review (push) Has been cancelled
Validate Manifests / YAML Lint (push) Has been cancelled
Validate Manifests / Kustomize Build Test (push) Has been cancelled
Validate Manifests / Kubernetes Schema Validation (push) Has been cancelled
Best Practices / Kube-score Analysis (push) Has been cancelled
- Add namespace.yaml with istio ambient + waypoint labels
- Add waypoint Gateway (istio-waypoint) scoped to irc namespace
- Switch thelounge HTTPRoute from Cilium external to istio-external gateway
- Add AuthorizationPolicy for thelounge (allow inbound from gateway-system only)
- Add AuthorizationPolicy for znc (allow all on port 6501 for IRC clients)
- Add namespace: irc to root kustomization, remove dependency on targetNamespace
Generated with [Claude Code](https://claude.ai/code )
via [Happy](https://happy.engineering )
Co-Authored-By: Claude <noreply@anthropic.com >
Co-Authored-By: Happy <yesreply@happy.engineering >
2026-05-15 21:02:10 -04:00
Chris Farhood
a0df6cd978
chore: remove NetworkPolicy resources for IRC apps
2026-02-10 12:48:09 -05:00
Chris Farhood
531fe04ffe
networkpolicy correction
2026-01-17 12:29:03 -05:00
Chris Farhood
e2cf8ff1b0
adding kustomizations to force declaration of manifests
2026-01-17 09:12:48 -05:00
Chris Farhood