Running customer Helm charts in a dedicated pod — why it left the shared agent, what helm reads from a chart, process limits, matching Argo CD’s render conditions, and a NetworkPolicy controller that had been off all along.
Having a path is not the same as being allowed to use it — a three-Pod lab (diagnostic, Go web server, PostgreSQL) shows what a NetworkPolicy really is: a per-Pod, per-direction allow list where both the sender’s egress door and the receiver’s ingress door must open, allow rules only add up, an empty selector, an empty list and an empty rule mean three different things, a hyphen in YAML decides AND versus OR, and the standard API stops at the TCP port while Cilium’s Envoy can refuse a single HTTP path with a 403.