fix contour

helm-overrides/k8s-admin-prd-ase1/contour/custom-values.yaml

@@ -38,7 +38,15 @@ contour:
 
   envoy:
     dnsPolicy: ClusterFirstWithHostNet
-    hostNetwork: true
+    # Mistake in an earlier version of this file: this was `true`. claude.md
+    # is explicit that hostPort was chosen specifically INSTEAD of
+    # hostNetwork ("not full hostNetwork, which is heavier-handed and
+    # affects pod DNS") — and hostNetwork: true also has a real API
+    # constraint that broke sync: it requires hostPort == containerPort on
+    # every port, which isn't the case here (containerPort 8080/8443 vs
+    # hostPort 80/443). `false` is both what was actually decided and what
+    # the API requires for this containerPort/hostPort combination.
+    hostNetwork: false
     useHostPort:
       http: true
       https: true
@@ -55,3 +63,7 @@ contour:
         memory: 64Mi
     service:
       type: ClusterIP
+      # Chart default (Local) pairs with the default type: LoadBalancer —
+      # only valid for LoadBalancer/NodePort services. Must be cleared for
+      # ClusterIP, which is what the sync error actually said.
+      externalTrafficPolicy: ""