How do I replicate a helm install without --wait for a Chart that has dependencies and a Job and postInstall?

[Skarlso]

Hello.

I have a chart here: https://github.com/open-component-model/ocm-controller/tree/main/deploy

The chart has a cert-manager dependency and creates certificates for the deployments.

To avoid creating the certificate too early, a job is created that checks if cert-manager is up and running:

{{- if index .Values "cert-manager" "enabled" }}
apiVersion: batch/v1
kind: Job
metadata:
  name: wait-for-cert-manager
  namespace: cert-manager
  labels:
    app: {{ .Release.Name }}-wait-for-cert-manager
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
  template:
    spec:
      serviceAccountName: wait-for-cert-manager-sa
      containers:
        - name: wait-for-cert-manager
          image: bitnami/kubectl:latest
          command:
            - /bin/sh
            - -c
            - |
              kubectl wait --for=condition=Available=True Deployment/cert-manager -n cert-manager --timeout=60s
              kubectl wait --for=condition=Available=True Deployment/cert-manager-webhook -n cert-manager --timeout=60s
              kubectl wait --for=condition=Available=True Deployment/cert-manager-cainjector -n cert-manager --timeout=60s
      restartPolicy: OnFailure
{{- end}}

Install it with the following command:

helm install ocm-controller ./deploy --set "manager.image.tag=v0.21.4" --set cert-manager.enabled=true

This launches a Job that will wait for CertManager to be available before applying the certificate to create the right certificate for the registry that we are deploying.

I'm trying to use a HelmRelease like this to replicate this behaviour:

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: ocm
  namespace: default
spec:
  interval: 30m
  install:
    disableWait: true
  chartRef:
    kind: OCIRepository
    name: ocm-controller
  releaseName: ocm-controller
  values:
    cert-manager:
      enabled: true

But it keeps failing the helm release. If I add remediation.retries: -1 then as soon as the job passes it goes and terminates everything and uninstalls everything for whatever reason. :/

I'm stuck at this point trying to figure out how to proceed.

[stefanprodan]

You don’t need such a job, Flux dependsOn does it for you. See here an example repo: https://github.com/fluxcd/flux2-kustomize-helm-example

[Skarlso]

As far as I know, dependsOn: is only available for Kustomization, not? 🤔

[Skarlso]

Oh I see what you mean here.

So... but this would make things work with Flux, right? I still would need something that makes it work with plain helm install.

Helm install won't care about kustomize and I need the wait for Issuer to be applied otherwise the webhook errors.

[Skarlso]

@stefanprodan I've built this: https://github.com/open-component-model/ocm-controller/pull/512/files

But it's actually applying the config first and the rest of the three kustomize files are not applied in the order that dependsOn is defining. 🤔 Did I not set those right? Do I have to put them into separate folders?

This is the main file I'm trying to apply: https://github.com/open-component-model/ocm-controller/blob/da4ab9f329cad94f65dca27836f23814e3222c0a/deploy/flux/controller_kustomization.yaml

[Skarlso]

Yep, that was it. I had to put it into its own folder. :)