Fix netbird-operator namespace reference in istio mesh policies

allow-netbird-operator-access (AuthorizationPolicy) and the netbird-operator
PeerAuthentication both targeted namespace 'netbird-operator', which has
never existed - the actual netbird-operator pod runs in the 'netbird'
namespace. This permanently blocked istio-mesh-config from going Synced
(kubectl apply failed: namespaces "netbird-operator" not found on every
sync attempt).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure/istio/manifests/mesh/authorization-policies.yaml

@@ -275,7 +275,7 @@ spec:
     - from:
         - source:
             namespaces:
-              - netbird-operator
+              - netbird
     - from:
         - source:
             namespaces:
@@ -288,11 +288,15 @@ spec:
 
 ---
 # --- Netbird Operator: Allow intra-namespace + Prometheus ---
+# Operator runs in the "netbird" namespace, not "netbird-operator" (which
+# doesn't exist) - fixed 2026-08-17, was blocking istio-mesh-config from
+# ever going Synced (kubectl apply failed: "namespaces netbird-operator
+# not found").
 apiVersion: security.istio.io/v1
 kind: AuthorizationPolicy
 metadata:
   name: allow-netbird-operator-access
-  namespace: netbird-operator
+  namespace: netbird
 spec:
   action: ALLOW
   rules:
@@ -300,7 +304,7 @@ spec:
     - from:
         - source:
             namespaces:
-              - netbird-operator
+              - netbird
     # Prometheus scraping (L4-only)
     - from:
         - source:

infrastructure/istio/manifests/mesh/peer-authentication-webhooks.yaml

@@ -23,11 +23,13 @@ spec:
     mode: PERMISSIVE
 ---
 # Netbird operator webhook receives calls from the API server
+# (namespace is "netbird", not "netbird-operator" - that namespace
+# doesn't exist; fixed 2026-08-17)
 apiVersion: security.istio.io/v1
 kind: PeerAuthentication
 metadata:
   name: allow-apiserver-webhooks
-  namespace: netbird-operator
+  namespace: netbird
 spec:
   mtls:
     mode: PERMISSIVE