Telegraf on VKS: the dependency that isn't in the README
The VKS Telegraf package mounts two secrets that only the Supervisor Management Proxy service propagates into guest clusters. Without it every pod sits in FailedMount forever and nothing says why. Install the proxy and the chain heals itself — then a second trap: a domainless output URL on any cluster created without serviceDomain.