Contour is installed by ArgoCD rather than by hand, which is only possible because nothing in the bootstrap path needed an ingress: ArgoCD reaches Gitea over cluster DNS. Its HTTPProxy CRD embeds a large schema, so the entry uses ServerSideApply for the same reason cert-manager's does. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N