From 2b1d3e904df40b2c09dbe5cfa217606187dc512c Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Mon, 29 Jun 2026 16:03:15 +0500
Subject: [PATCH] fix(kubernetes): gate vmop cert-manager-crds dependency on
 certManager.enabled

The victoria-metrics-operator HelmRelease is gated on
monitoringAgents.enabled but listed cert-manager-crds in dependsOn
unconditionally, while the cert-manager-crds HelmRelease is only
created when certManager.enabled is true. The valid combination
monitoringAgents.enabled=true + certManager.enabled=false therefore
left vmop blocked on a non-existent dependency
("...cert-manager-crds ... not found"), cascading to monitoring-agents
and vertical-pod-autoscaler. Gate the dependency on the same condition
that creates it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .../victoria-metrics-operator.yaml            |  2 +
 .../tests/victoria-metrics-operator_test.yaml | 77 +++++++++++++++++++
 2 files changed, 79 insertions(+)
 create mode 100644 packages/apps/kubernetes/tests/victoria-metrics-operator_test.yaml

diff --git a/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml b/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml
index d6c068ca6..476e470d0 100644
--- a/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml
@@ -31,6 +31,8 @@ spec:
   dependsOn:
   - name: {{ .Release.Name }}-cilium
     namespace: {{ .Release.Namespace }}
+  {{- if .Values.addons.certManager.enabled }}
   - name: {{ .Release.Name }}-cert-manager-crds
     namespace: {{ .Release.Namespace }}
+  {{- end }}
 {{- end }}
diff --git a/packages/apps/kubernetes/tests/victoria-metrics-operator_test.yaml b/packages/apps/kubernetes/tests/victoria-metrics-operator_test.yaml
new file mode 100644
index 000000000..d62a995ef
--- /dev/null
+++ b/packages/apps/kubernetes/tests/victoria-metrics-operator_test.yaml
@@ -0,0 +1,77 @@
+suite: victoria-metrics-operator.yaml cert-manager-crds dependency gating
+
+templates:
+  - templates/helmreleases/victoria-metrics-operator.yaml
+
+values:
+  - values/common.yaml
+
+# The vmop HelmRelease is gated on monitoringAgents.enabled, but the
+# cert-manager-crds HelmRelease it can depend on is only created when
+# certManager.enabled is true. The dependsOn entry must therefore be gated on
+# the same condition, otherwise the valid combination
+# monitoringAgents.enabled=true + certManager.enabled=false leaves vmop blocked
+# on a non-existent dependency.
+
+tests:
+  - it: renders the vmop HelmRelease when monitoringAgents is enabled
+    release:
+      name: kubernetes-test
+      namespace: tenant-test
+    set:
+      addons.monitoringAgents.enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: HelmRelease
+      - equal:
+          path: metadata.name
+          value: kubernetes-test-cozy-victoria-metrics-operator
+
+  - it: always depends on cilium
+    release:
+      name: kubernetes-test
+      namespace: tenant-test
+    set:
+      addons.monitoringAgents.enabled: true
+    asserts:
+      - contains:
+          path: spec.dependsOn
+          content:
+            name: kubernetes-test-cilium
+            namespace: tenant-test
+
+  - it: does NOT depend on cert-manager-crds when certManager is disabled
+    release:
+      name: kubernetes-test
+      namespace: tenant-test
+    set:
+      addons.monitoringAgents.enabled: true
+      addons.certManager.enabled: false
+    asserts:
+      - notContains:
+          path: spec.dependsOn
+          content:
+            name: kubernetes-test-cert-manager-crds
+            namespace: tenant-test
+      - lengthEqual:
+          path: spec.dependsOn
+          count: 1
+
+  - it: depends on cert-manager-crds when certManager is enabled
+    release:
+      name: kubernetes-test
+      namespace: tenant-test
+    set:
+      addons.monitoringAgents.enabled: true
+      addons.certManager.enabled: true
+    asserts:
+      - contains:
+          path: spec.dependsOn
+          content:
+            name: kubernetes-test-cert-manager-crds
+            namespace: tenant-test
+      - lengthEqual:
+          path: spec.dependsOn
+          count: 2