A NetworkPolicy permits the application path while node-local DNS forwarding now uses a different source identity than the rule expected during a staged decommission

App traffic is allowed, yet name resolution fails because the helper path no longer matches policy assumptions. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.