fix(cloudflared): auditable Service+ServiceMonitor scrape; placeholder-only template value

servicemonitor-ports-resolve could not audit a PodMonitor with no in-repo Service, and no-plaintext-secrets requires a template's secret value to be a bare placeholder. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-11-08 12:39:56 -06:00
1 parent aabc8c60b6
commit 09f219fe7f
@@ -31,7 +31,7 @@ spec:
          port: 53
 ---
 # The ONLY ingress: Prometheus scraping :2000. Shipped in the same file as the baseline on purpose
-# (the Longhorn/kured lesson): a deny-all without this allow leaves the PodMonitor's targets
+# (the Longhorn/kured lesson): a deny-all without this allow leaves the ServiceMonitor's targets
 # DISCOVERED and every scrape timing out, which is the state the CloudflaredTunnelDown rule is
 # written to fire on rather than go quiet in.
 apiVersion: networking.k8s.io/v1