From bbb80687ca26e9c245cdadf87d66c75cec979a8c Mon Sep 17 00:00:00 2001
From: Scooby Husky <garrettstone499@gmail.com>
Date: Mon, 17 Aug 2026 18:20:00 -0500
Subject: [PATCH] Fix netbird-operator namespace reference in istio mesh
 policies

allow-netbird-operator-access (AuthorizationPolicy) and the netbird-operator
PeerAuthentication both targeted namespace 'netbird-operator', which has
never existed - the actual netbird-operator pod runs in the 'netbird'
namespace. This permanently blocked istio-mesh-config from going Synced
(kubectl apply failed: namespaces "netbird-operator" not found on every
sync attempt).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../istio/manifests/mesh/authorization-policies.yaml   | 10 +++++++---
 .../manifests/mesh/peer-authentication-webhooks.yaml   |  4 +++-
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/infrastructure/istio/manifests/mesh/authorization-policies.yaml b/infrastructure/istio/manifests/mesh/authorization-policies.yaml
index eabe042..6a5352b 100644
--- a/infrastructure/istio/manifests/mesh/authorization-policies.yaml
+++ b/infrastructure/istio/manifests/mesh/authorization-policies.yaml
@@ -275,7 +275,7 @@ spec:
     - from:
         - source:
             namespaces:
-              - netbird-operator
+              - netbird
     - from:
         - source:
             namespaces:
@@ -288,11 +288,15 @@ spec:
 
 ---
 # --- Netbird Operator: Allow intra-namespace + Prometheus ---
+# Operator runs in the "netbird" namespace, not "netbird-operator" (which
+# doesn't exist) - fixed 2026-08-17, was blocking istio-mesh-config from
+# ever going Synced (kubectl apply failed: "namespaces netbird-operator
+# not found").
 apiVersion: security.istio.io/v1
 kind: AuthorizationPolicy
 metadata:
   name: allow-netbird-operator-access
-  namespace: netbird-operator
+  namespace: netbird
 spec:
   action: ALLOW
   rules:
@@ -300,7 +304,7 @@ spec:
     - from:
         - source:
             namespaces:
-              - netbird-operator
+              - netbird
     # Prometheus scraping (L4-only)
     - from:
         - source:
diff --git a/infrastructure/istio/manifests/mesh/peer-authentication-webhooks.yaml b/infrastructure/istio/manifests/mesh/peer-authentication-webhooks.yaml
index b67e764..fd4f9c9 100644
--- a/infrastructure/istio/manifests/mesh/peer-authentication-webhooks.yaml
+++ b/infrastructure/istio/manifests/mesh/peer-authentication-webhooks.yaml
@@ -23,11 +23,13 @@ spec:
     mode: PERMISSIVE
 ---
 # Netbird operator webhook receives calls from the API server
+# (namespace is "netbird", not "netbird-operator" - that namespace
+# doesn't exist; fixed 2026-08-17)
 apiVersion: security.istio.io/v1
 kind: PeerAuthentication
 metadata:
   name: allow-apiserver-webhooks
-  namespace: netbird-operator
+  namespace: netbird
 spec:
   mtls:
     mode: PERMISSIVE