The ServiceMonitor added in #865 discovers both external-dns targets and then times out on them: the apps namespace is default-deny-ingress, so the scrape never arrives. lastError: Get "http://10.244.2.218:7979/metrics": context deadline exceeded health: down Same shape as gitea-allow-metrics-scrape, and one policy covers both releases — the chart gives them the same app.kubernetes.io/name and they share the namespace, even though external-dns-unifi is declared under infrastructure/. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>