From 71d0b171e675c7ddf5b50647ffec349ccd96e973 Mon Sep 17 00:00:00 2001
From: jenkins <brad@bstein.dev>
Date: Sun, 13 Sep 2026 20:45:09 -0500
Subject: [PATCH] flux: allow degraded Vault provider fleets during workload
 rollouts

---
 .../platform/vault-csi/kustomization.yaml     | 22 +++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/clusters/atlas/flux-system/platform/vault-csi/kustomization.yaml b/clusters/atlas/flux-system/platform/vault-csi/kustomization.yaml
index 7f13c12b..c0bf94e6 100644
--- a/clusters/atlas/flux-system/platform/vault-csi/kustomization.yaml
+++ b/clusters/atlas/flux-system/platform/vault-csi/kustomization.yaml
@@ -5,7 +5,7 @@ metadata:
   name: vault-csi
   namespace: flux-system
   annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
+    kustomize.toolkit.fluxcd.io/ssa: Override
 spec:
   interval: 30m
   sourceRef:
@@ -14,5 +14,23 @@ spec:
     namespace: flux-system
   path: ./infrastructure/vault-csi
   prune: true
-  wait: true
+  # A cordoned, unavailable node must not block unrelated workload rollouts.
+  # Keep the CSI driver gate and require at least one observed healthy provider.
+  wait: false
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      name: secrets-store-csi-driver
+      namespace: kube-system
+    - apiVersion: apps/v1
+      kind: DaemonSet
+      name: vault-csi-provider
+      namespace: kube-system
+  healthCheckExprs:
+    - apiVersion: apps/v1
+      kind: DaemonSet
+      current: >-
+        has(status.observedGeneration) && has(metadata.generation) &&
+        status.observedGeneration >= metadata.generation &&
+        has(status.numberAvailable) && status.numberAvailable > 0
   targetNamespace: kube-system