From 69cb7b5f18e16148920f53bafc4e4c2be3b4deb2 Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Fri, 15 May 2026 10:26:00 +0500 Subject: [PATCH 1/2] fix(platform): add cert-manager dependency to webhook-cert consumers Five PackageSources whose charts apply cert-manager Certificate CRs and mount the resulting Secret on a webhook Deployment lacked an explicit dependsOn: cozystack.cert-manager. Under Flux v2.8 helm-controller v1.5.0 kstatus, the dependent Deployment trips progressDeadlineSeconds (10m default) when cert-manager controller isn't running yet, and the HR is failed early. Repeatedly observed on PR #2619 with capi-operator, kamaji, rabbitmq-operator, cozystack-api (cozystack-engine), and ingress-nginx all cascading to InstallFailed at ~12-15m into a fresh install. The mariadb-operator, kubeovn-webhook, snapshot-controller, etcd-operator, postgres-operator, mongodb-operator, victoria-metrics-operator, linstor, and linstor-scheduler PackageSources already had the dependency, which is why they weren't in the failure set. Assisted-By: Claude Signed-off-by: Myasnikov Daniil (cherry picked from commit 0fc0796b19cd6e8ed923b47c63d47bfe9ea5ef2a) --- packages/core/platform/sources/capi-operator.yaml | 1 + packages/core/platform/sources/cozystack-engine.yaml | 1 + packages/core/platform/sources/ingress-nginx.yaml | 1 + packages/core/platform/sources/kamaji.yaml | 1 + packages/core/platform/sources/rabbitmq-operator.yaml | 1 + 5 files changed, 5 insertions(+) diff --git a/packages/core/platform/sources/capi-operator.yaml b/packages/core/platform/sources/capi-operator.yaml index a45364027..102298635 100644 --- a/packages/core/platform/sources/capi-operator.yaml +++ b/packages/core/platform/sources/capi-operator.yaml @@ -13,6 +13,7 @@ spec: - name: default dependsOn: - cozystack.networking + - cozystack.cert-manager components: - name: capi-operator path: system/capi-operator diff --git a/packages/core/platform/sources/cozystack-engine.yaml b/packages/core/platform/sources/cozystack-engine.yaml index 596c81c45..91ed81c0a 100644 --- a/packages/core/platform/sources/cozystack-engine.yaml +++ b/packages/core/platform/sources/cozystack-engine.yaml @@ -13,6 +13,7 @@ spec: - name: default dependsOn: - cozystack.networking + - cozystack.cert-manager libraries: - name: cozy-lib path: library/cozy-lib diff --git a/packages/core/platform/sources/ingress-nginx.yaml b/packages/core/platform/sources/ingress-nginx.yaml index b51e096f6..466d2c441 100644 --- a/packages/core/platform/sources/ingress-nginx.yaml +++ b/packages/core/platform/sources/ingress-nginx.yaml @@ -14,6 +14,7 @@ spec: dependsOn: - cozystack.networking - cozystack.prometheus-operator-crds + - cozystack.cert-manager components: - name: ingress-nginx path: system/ingress-nginx diff --git a/packages/core/platform/sources/kamaji.yaml b/packages/core/platform/sources/kamaji.yaml index 915c5898d..434fd454d 100644 --- a/packages/core/platform/sources/kamaji.yaml +++ b/packages/core/platform/sources/kamaji.yaml @@ -13,6 +13,7 @@ spec: - name: default dependsOn: - cozystack.networking + - cozystack.cert-manager components: - name: kamaji path: system/kamaji diff --git a/packages/core/platform/sources/rabbitmq-operator.yaml b/packages/core/platform/sources/rabbitmq-operator.yaml index 843ceb479..6845414a2 100644 --- a/packages/core/platform/sources/rabbitmq-operator.yaml +++ b/packages/core/platform/sources/rabbitmq-operator.yaml @@ -13,6 +13,7 @@ spec: - name: default dependsOn: - cozystack.networking + - cozystack.cert-manager components: - name: rabbitmq-operator path: system/rabbitmq-operator From 535f881160982f45f52db344a29c365dc1063bdc Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Tue, 26 May 2026 15:54:49 +0500 Subject: [PATCH 2/2] fix(platform): include cert-manager in cozystack-engine oidc variant The oidc variant installs system/cozystack-api and system/lineage-controller-webhook, both of which render cert-manager.io/v1 Certificate resources. Add cozystack.cert-manager to the oidc variant's dependsOn so it matches the default variant and webhook-cert consumers do not race the cert-manager controller on cold installs. Address review feedback from gemini-code-assist and coderabbitai on packages/core/platform/sources/cozystack-engine.yaml. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- packages/core/platform/sources/cozystack-engine.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/packages/core/platform/sources/cozystack-engine.yaml b/packages/core/platform/sources/cozystack-engine.yaml index 91ed81c0a..664536174 100644 --- a/packages/core/platform/sources/cozystack-engine.yaml +++ b/packages/core/platform/sources/cozystack-engine.yaml @@ -58,6 +58,7 @@ spec: - name: oidc dependsOn: - cozystack.networking + - cozystack.cert-manager - cozystack.keycloak - cozystack.keycloak-operator libraries: