fix(etcd): use post-install hook for DataStore creation

DataStore references TLS Secrets (etcd-ca-tls, etcd-client-tls) that are
created as pre-install hooks but remain empty until cert-manager processes
the Certificate CRs and populates them.

Creating DataStore immediately during install creates a race condition:
- Helm creates empty Secrets (pre-install hook)
- Helm creates Certificate CRs
- Helm creates DataStore (references Secrets)
- cert-manager asynchronously populates Secrets
- Kamaji webhook validates DataStore TLS config
- Validation fails if Secrets are still empty
- DataStore creation fails silently

Using post-install hook with weight 10 ensures DataStore is created
AFTER all other resources (including Certificates), giving cert-manager
time to populate the Secrets before DataStore references them.

Complements atomic install fix in tenant chart.
Related to #2412.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
This commit is contained in:
IvanHunters committed 2026-04-24 23:20:09 +03:00
1 parent 6b2425fd25
commit 5ff57ae82d
1 file changed
+3
@@ -3,6 +3,9 @@ apiVersion: kamaji.clastix.io/v1alpha1
kind: DataStore
metadata:
name: {{ .Release.Namespace }}
annotations:
helm.sh/hook: post-install,post-upgrade
helm.sh/hook-weight: "10"
spec:
driver: etcd
endpoints: