claude-botandClaude Opus 5
939028fadd
One unknown kind fails a server-side dry-run for the WHOLE apply set, including the very HelmRelease that would have installed the missing CRDs. On a running cluster every CRD exists, so this never showed; a cold rebuild deadlocks on it immediately. Three groups move, content unchanged: ExternalSecrets and Traefik Middlewares out of infrastructure into post-crds, which reconciles after the operators. The flux-git ExternalSecret also changes creationPolicy Merge -> Orphan with deletionPolicy Retain: Merge never CREATES the target secret, so on a fresh cluster the Gitea credential handover silently did not happen. ServiceMonitors/PodMonitors out of their charts and app sets into apps/monitoring-rules, which applies after kube-prometheus-stack owns the CRDs. Rook additionally stops creating its own two monitors (spec.monitoring.enabled: false) — creating them is fatal to its node-daemon reconcile when the CRD is missing, which held the CephCluster in Progressing and with it the whole apps layer. Both objects are reproduced field for field off the live cluster; the ceph-exporter DaemonSet and the metrics endpoints are untouched. Cilium is the worst case: its chart aborts rendering outright on the missing CRD, and cilium is one of the seven infrastructure healthChecks — the lowest layer in the cluster waiting on the highest. Steady-state effect: object ownership moves between Kustomizations; specs are identical. Verified on local vmtest runs and the Hetzner throwaway cluster. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>