- Set ingress host to tavana-dev.int.nokia.com with TLS
- Add kubernetes.io/ingress.allow-http: "false" to block HTTP
- Add appgw.ingress.kubernetes.io/use-private-ip and ssl-certificate
- Add automountServiceAccountToken: false to worker pods and ServiceAccount
- Explicitly set automountServiceAccountToken: true on gateway (needs K8s API)

Made-with: Cursor