DataNivra agent {{ include "datanivra-agent.fullname" . }} installed (outbound-only; no Service).

1. Enrollment / health (the pod becomes Ready once identity.json exists):
     kubectl -n {{ .Release.Namespace }} get pod {{ include "datanivra-agent.fullname" . }}-0
   In the console: Agents -> "{{ default (include "datanivra-agent.fullname" .) .Values.agentName }}" should be ACTIVE
   (OFFLINE = no heartbeat for ~3 minutes: check egress to {{ .Values.controlPlaneUrl }}).

2. Logs (JSON, value-free; never contain rows or secret values):
     kubectl -n {{ .Release.Namespace }} logs statefulset/{{ include "datanivra-agent.fullname" . }} -f

3. Local egress-violation log (blocked outbound payloads, recorded without the payload):
     kubectl -n {{ .Release.Namespace }} exec {{ include "datanivra-agent.fullname" . }}-0 -- python -m datanivra_agent.cli violations

{{- if .Values.enrollment.createSecret }}

WARNING: enrollment.createSecret=true stores the enrollment token in the Helm release history.
Use enrollment.existingSecret for production installs.
{{- end }}
{{- if not (include "datanivra-agent.enrollmentSecret" .) }}

NOTE: no enrollment Secret configured. A fresh volume cannot enroll; set enrollment.existingSecret.
{{- end }}
