FluxCD dry-run fails when CRD-dependent resources (ClusterIssuer, CephCluster) are in the same Kustomization as the HelmReleases that install those CRDs. Split into 3 stages: 1. infrastructure/ - namespaces, HelmReleases (installs CRDs) 2. post-crds/ - ClusterIssuer (needs cert-manager CRDs) 3. rook-ceph-cluster/ - CephCluster, StorageClasses (needs Rook CRDs) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>