Pushgateway Heartbeat Gotcha: When ndots and NetworkPolicy Silently Eat Your Alerts

How ndots:5, a wildcard DNS record, and a default-deny NetworkPolicy combine to swallow CronJob heartbeats without a single error or alert.