diff --git a/kubernetes/clusters/homelab/paperclip.yaml b/kubernetes/clusters/homelab/paperclip.yaml index fbd95f6a..efbd6d8d 100644 --- a/kubernetes/clusters/homelab/paperclip.yaml +++ b/kubernetes/clusters/homelab/paperclip.yaml @@ -14,6 +14,25 @@ spec: prune: true wait: true dependsOn: + # Deliberately NOT dependsOn: monitoring, even though + # apps/paperclip/prometheus-read-rbac.yaml puts a Role and a RoleBinding in + # namespace `monitoring` (REN-86). + # + # The only thing those two objects need first is the namespace, and the + # namespace does not come from the `monitoring` Kustomization — it is + # declared in infrastructure/namespaces/namespaces.yaml and applied by + # `infrastructure`, listed right below. `infrastructure` runs wait: false, so + # it applies the namespaces on its first pass and only its healthChecks hold + # its readiness, which is strictly later; by the time this Kustomization + # starts, `monitoring` exists. Role and RoleBinding are core RBAC kinds, and + # a RoleBinding is allowed to name a Role that does not exist yet, so + # nothing on this path waits on kube-prometheus-stack's CRDs or workloads. + # + # The edge would not be free either. `monitoring` dependsOn `grafana-db` and + # itself waits (wait: true, 30m) on kube-prometheus-stack, Loki, Alloy and + # blackbox-exporter. Adding it would stop the Kustomization that carries the + # paperclip pod from reconciling whenever any of that is unhealthy — a real + # coupling bought for a bootstrap-ordering problem that does not exist. - name: infrastructure - name: infrastructure-crds - name: infrastructure-ceph-cluster