From e382968285fef8e1eef6f36dfdde4a7d883d3cb0 Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Wed, 15 Apr 2026 18:34:11 +0500 Subject: [PATCH] [seaweedfs] Wait for ingress-nginx-system before creating Ingress Without this, the outer tenant HelmReleases apply both seaweedfs and ingress in parallel, which in turn creates their inner HelmReleases (seaweedfs-system and ingress-nginx-system) in parallel too. When seaweedfs-system tries to create its Ingress before the nginx admission webhook's Service/endpoint state has finished reconciling on the CNI, the apiserver's webhook call fails with: failed calling webhook "validate.nginx.ingress.kubernetes.io": dial tcp ...:443: connect: operation not permitted and flux rolls back the install. E2E recovers via the "Retry install" loop but it's flaky and adds minutes to every run. Adding dependsOn: ingress-nginx-system on the inner seaweedfs HR makes flux block the install until the ingress chart is Ready, which means the controller Deployment is Available and its webhook endpoint is routable before the first Ingress is created. Guarded by {{- if \$ingress }} so this only kicks in for tenants that have ingress enabled (i.e. tenant-root in the default topology). Co-Authored-By: Claude Opus 4.6 Signed-off-by: Myasnikov Daniil --- packages/extra/seaweedfs/templates/seaweedfs.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/packages/extra/seaweedfs/templates/seaweedfs.yaml b/packages/extra/seaweedfs/templates/seaweedfs.yaml index 42441b26..fd528aa5 100644 --- a/packages/extra/seaweedfs/templates/seaweedfs.yaml +++ b/packages/extra/seaweedfs/templates/seaweedfs.yaml @@ -104,6 +104,11 @@ metadata: labels: sharding.fluxcd.io/key: tenants spec: + {{- if $ingress }} + # Ensure the ingress-nginx admission webhook is ready before creating Ingress resources. + dependsOn: + - name: ingress-nginx-system + {{- end }} chartRef: kind: ExternalArtifact name: cozystack-seaweedfs-application-default-seaweedfs-system