[kagenti-operator] Auto-label namespaces with istio-discovery=enabled when AgentRuntime CR is created

[r3v5]

Problem

When a user creates a new namespace and deploys an agent with an AgentRuntime CR, the namespace is not automatically enrolled in the Istio ambient mesh. The istio-discovery: enabled label (and istio.io/dataplane-mode: ambient) must be present on the namespace for ztunnel to provide L4 mTLS encryption.

Today, Helm charts pre-label namespaces from a static values list (agent-namespaces.yaml, mcp-gateway-namespaces.yaml). Dynamically created namespaces are not labeled, meaning agent pod traffic is plaintext at L4 even though AuthBridge sidecars handle application-layer auth.

Current Behavior

1. User creates namespace team1
2. Deploys agent workload with AgentRuntime CR
3. AgentRuntime controller labels the workload with kagenti.io/type=agent ✅
4. AuthBridge webhook injects sidecar into pods ✅
5. Namespace has no istio-discovery: enabled label → not in mesh ❌
6. ztunnel does not intercept traffic → no mTLS at transport layer

Expected Behavior

When an AgentRuntime CR is created in a namespace that lacks istio-discovery: enabled, the operator should auto-label the namespace to enroll it in the ambient mesh.

Labels to add:

istio-discovery: enabled
istio.io/dataplane-mode: ambient

Considerations

• Should this be opt-in or opt-out? (e.g., annotation on namespace to skip auto-labeling)
• Should it also add istio.io/use-waypoint: waypoint like the Helm chart does for agent namespaces?
• RBAC: operator needs permission to patch Namespace objects (currently not in ClusterRole)
• Should the label be removed if all AgentRuntime CRs are deleted from the namespace?
• Interaction with discoverySelectors in Istio CR — only labeled namespaces are discovered

References

• Istio ambient mode namespace enrollment: namespaces need istio-discovery: enabled for discoverySelectors
• Current Helm-based labeling: charts/kagenti/templates/agent-namespaces.yaml, charts/kagenti-deps/templates/istio-namespace.yaml
• Related epic: RHAIENG-4898 (operator-driven platform deployment)

[r3v5]

/assign