flux: allow degraded Vault provider fleets during workload rollouts

clusters/atlas/flux-system/platform/vault-csi/kustomization.yaml

@@ -5,7 +5,7 @@ metadata:
   name: vault-csi
   namespace: flux-system
   annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
+    kustomize.toolkit.fluxcd.io/ssa: Override
 spec:
   interval: 30m
   sourceRef:
@@ -14,5 +14,23 @@ spec:
     namespace: flux-system
   path: ./infrastructure/vault-csi
   prune: true
-  wait: true
+  # A cordoned, unavailable node must not block unrelated workload rollouts.
+  # Keep the CSI driver gate and require at least one observed healthy provider.
+  wait: false
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      name: secrets-store-csi-driver
+      namespace: kube-system
+    - apiVersion: apps/v1
+      kind: DaemonSet
+      name: vault-csi-provider
+      namespace: kube-system
+  healthCheckExprs:
+    - apiVersion: apps/v1
+      kind: DaemonSet
+      current: >-
+        has(status.observedGeneration) && has(metadata.generation) &&
+        status.observedGeneration >= metadata.generation &&
+        has(status.numberAvailable) && status.numberAvailable > 0
   targetNamespace: kube-system