DL-544

The Server terminates its own TLS from an operator-supplied kubernetes.io/tls Secret and loads it once, so a renewed certificate takes effect on restart; no ingress terminates TLS, serverAddr is the in-cluster Service, external access is TCP passthrough, and a private CA reaches the Runner through serverCA and clients through –ca.

Status: Active (Matt, 2026-10-17)