openova/infra
e3mrah 0d75ae354f
fix(infra): split Cilium-Gateway Certificate into sovereign-tls Kustomization (Phase-8a bug #13) (#484)
Phase-8a-preflight live deployment 93161846839dc2e1: bootstrap-kit Flux
Kustomization fails server-side dry-run with

  Certificate/kube-system/sovereign-wildcard-tls dry-run failed:
  no matches for kind 'Certificate' in version 'cert-manager.io/v1'

→ entire Kustomization apply aborts → ZERO HelmReleases reconcile.

Fix: split the Certificate into its own Flux Kustomization sovereign-tls
that dependsOn bootstrap-kit (whose Ready gates on every HR including
bp-cert-manager). Gateway stays in 01-cilium.yaml because Gateway API
CRDs ship with Cilium itself.

Co-authored-by: hatiyildiz <hatiyildiz@noreply.github.com>
2026-05-01 22:48:18 +04:00
..
hetzner fix(infra): split Cilium-Gateway Certificate into sovereign-tls Kustomization (Phase-8a bug #13) (#484) 2026-05-01 22:48:18 +04:00