test-ingress OK; SOPS=decrypted-by-ksops-at-sync-time