From 6afc0eb370f827c55f478045d1aff2a329b25100 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 16 Apr 2026 20:55:17 +0300
Subject: [PATCH] fix(kubernetes): bound init wait and reword fail-fast message

Cap the wait-for-kubeconfig init container at 20m. If Kamaji genuinely
fails to produce the admin-kubeconfig Secret (misconfigured tenant,
etcd outage after the guard already passed, Kamaji crash-loop), the
pod now exits non-zero and goes CrashLoopBackOff so the failure is
visible in dashboards, instead of silently sleeping in Init forever
and leaving only the flux helm-wait timeout to surface the problem.

Reword the etcd DataStore guard to reference the parent Tenant
application's etcd flag (not .Values.etcd of the Kubernetes chart,
which is a different chart). Update the helm unittest errorPattern
accordingly.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../kubernetes/templates/cluster-autoscaler/deployment.yaml  | 5 +++++
 packages/apps/kubernetes/templates/cluster.yaml              | 2 +-
 packages/apps/kubernetes/templates/csi/deploy.yaml           | 5 +++++
 packages/apps/kubernetes/templates/kccm/manager.yaml         | 5 +++++
 .../apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml    | 2 +-
 5 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
index 47c22f76..277b6df8 100644
--- a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
+++ b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
@@ -31,7 +31,12 @@ spec:
         - -c
         - |
           set -eu
+          deadline=$(( $(date +%s) + 1200 ))
           until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
+            if [ "$(date +%s)" -ge "$deadline" ]; then
+              echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
+              exit 1
+            fi
             echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
             sleep 5
           done
diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index 99249c1a..1747df4e 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -1,6 +1,6 @@
 {{- $etcd := .Values._namespace.etcd }}
 {{- if not $etcd }}
-{{- fail "Kubernetes tenant requires a parent tenant with etcd enabled: set .Values.etcd=true on tenant-root (or any ancestor tenant), wait for the etcd HelmRelease to reconcile (DataStore CR appears in the tenant namespace), then retry." }}
+{{- fail "Kubernetes tenant requires a parent Tenant application with etcd: true so the etcd module deploys a DataStore CR in the tenant namespace. Set spec.etcd: true on the root Tenant (or any ancestor Tenant), wait for the etcd HelmRelease to reconcile and the DataStore CR to appear, then retry." }}
 {{- end }}
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
diff --git a/packages/apps/kubernetes/templates/csi/deploy.yaml b/packages/apps/kubernetes/templates/csi/deploy.yaml
index 2979c75c..ff170cb8 100644
--- a/packages/apps/kubernetes/templates/csi/deploy.yaml
+++ b/packages/apps/kubernetes/templates/csi/deploy.yaml
@@ -32,7 +32,12 @@ spec:
           - -c
           - |
             set -eu
+            deadline=$(( $(date +%s) + 1200 ))
             until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
+              if [ "$(date +%s)" -ge "$deadline" ]; then
+                echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
+                exit 1
+              fi
               echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
               sleep 5
             done
diff --git a/packages/apps/kubernetes/templates/kccm/manager.yaml b/packages/apps/kubernetes/templates/kccm/manager.yaml
index 5c7f15a4..67321647 100644
--- a/packages/apps/kubernetes/templates/kccm/manager.yaml
+++ b/packages/apps/kubernetes/templates/kccm/manager.yaml
@@ -30,7 +30,12 @@ spec:
         - -c
         - |
           set -eu
+          deadline=$(( $(date +%s) + 1200 ))
           until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
+            if [ "$(date +%s)" -ge "$deadline" ]; then
+              echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
+              exit 1
+            fi
             echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
             sleep 5
           done
diff --git a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
index 3b2b1d72..2a43e13f 100644
--- a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
+++ b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
@@ -116,4 +116,4 @@ tests:
         host: ""
     asserts:
       - failedTemplate:
-          errorPattern: "requires a parent tenant with etcd enabled"
+          errorPattern: "requires a parent Tenant application with etcd: true"