- Add p1_ingress() phase to install nginx-ingress-controller - Create ingress-nginx namespace with privileged PodSecurity label - Disable ServiceMonitor during bootstrap (Prometheus CRDs not installed yet) - Add namespace.yaml with PodSecurity labels (allows hostPort) - Filter cert-manager CRD errors (will be created by ArgoCD) - Include ingress phase in bootstrap 'all' flow