From 5ff57ae82d217ac07b35eb39d2b1ebd152bfa852 Mon Sep 17 00:00:00 2001 From: IvanHunters Date: Fri, 24 Apr 2026 23:20:09 +0300 Subject: [PATCH] fix(etcd): use post-install hook for DataStore creation DataStore references TLS Secrets (etcd-ca-tls, etcd-client-tls) that are created as pre-install hooks but remain empty until cert-manager processes the Certificate CRs and populates them. Creating DataStore immediately during install creates a race condition: - Helm creates empty Secrets (pre-install hook) - Helm creates Certificate CRs - Helm creates DataStore (references Secrets) - cert-manager asynchronously populates Secrets - Kamaji webhook validates DataStore TLS config - Validation fails if Secrets are still empty - DataStore creation fails silently Using post-install hook with weight 10 ensures DataStore is created AFTER all other resources (including Certificates), giving cert-manager time to populate the Secrets before DataStore references them. Complements atomic install fix in tenant chart. Related to #2412. Signed-off-by: IvanHunters --- packages/extra/etcd/templates/datastore.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/packages/extra/etcd/templates/datastore.yaml b/packages/extra/etcd/templates/datastore.yaml index 2a4a9e05a..9798e864c 100644 --- a/packages/extra/etcd/templates/datastore.yaml +++ b/packages/extra/etcd/templates/datastore.yaml @@ -3,6 +3,9 @@ apiVersion: kamaji.clastix.io/v1alpha1 kind: DataStore metadata: name: {{ .Release.Namespace }} + annotations: + helm.sh/hook: post-install,post-upgrade + helm.sh/hook-weight: "10" spec: driver: etcd endpoints: