FluxCD dry-run fails when CRD-dependent resources (ClusterIssuer,
CephCluster) are in the same Kustomization as the HelmReleases that
install those CRDs. Split into 3 stages:
1. infrastructure/ - namespaces, HelmReleases (installs CRDs)
2. post-crds/ - ClusterIssuer (needs cert-manager CRDs)
3. rook-ceph-cluster/ - CephCluster, StorageClasses (needs Rook CRDs)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Lessons from manual validation run:
- Add privileged PodSecurity labels to metallb-system, rook-ceph, ingress namespaces
- Add Cilium HelmRelease with Talos-specific settings (cgroup, kubePrism)
- Consolidate all namespace definitions in namespaces/
- Update cert-manager to use crds.enabled instead of installCRDs
- Enable all infrastructure components in main kustomization
- Add Talos secrets to .gitignore (controlplane.yaml, talosconfig)
- Update node patches with correct install disk (vda) and zone labels
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>