- Add optional: true to secretKeyRef so ingress pods start without the bouncer key (CrowdSec deploys after infrastructure) - Move ingress bouncer SealedSecret to crowdsec app (creates in ingress namespace when CrowdSec deploys) - Ingress starts without CrowdSec, bouncer activates after secret appears Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>