kubernetes/clusters/homelab/paperclip.yaml

@@ -14,6 +14,25 @@ spec:
   prune: true
   wait: true
   dependsOn:
+    # Deliberately NOT dependsOn: monitoring, even though
+    # apps/paperclip/prometheus-read-rbac.yaml puts a Role and a RoleBinding in
+    # namespace `monitoring` (REN-86).
+    #
+    # The only thing those two objects need first is the namespace, and the
+    # namespace does not come from the `monitoring` Kustomization — it is
+    # declared in infrastructure/namespaces/namespaces.yaml and applied by
+    # `infrastructure`, listed right below. `infrastructure` runs wait: false, so
+    # it applies the namespaces on its first pass and only its healthChecks hold
+    # its readiness, which is strictly later; by the time this Kustomization
+    # starts, `monitoring` exists. Role and RoleBinding are core RBAC kinds, and
+    # a RoleBinding is allowed to name a Role that does not exist yet, so
+    # nothing on this path waits on kube-prometheus-stack's CRDs or workloads.
+    #
+    # The edge would not be free either. `monitoring` dependsOn `grafana-db` and
+    # itself waits (wait: true, 30m) on kube-prometheus-stack, Loki, Alloy and
+    # blackbox-exporter. Adding it would stop the Kustomization that carries the
+    # paperclip pod from reconciling whenever any of that is unhealthy — a real
+    # coupling bought for a bootstrap-ordering problem that does not exist.
     - name: infrastructure
     - name: infrastructure-crds
     - name: infrastructure-ceph-cluster