- ingress-nginx requires hostPort (80/443) which is forbidden at baseline level - Change to restricted enforcement level to allow hostPort - Other namespaces remain at baseline for security
- ArgoCD migrated to argocd namespace - Cert-manager issuers/certs created - 20 namespaces imported with pod-security labels - S3 backend temporarily offline (MinIO), using local backup - Pending: Remove metadata drift from helm releases, re-apply