Dependencies & health

Order and readiness gates.

Ordering across Kustomizations and HelmReleases is expressed with dependsOn: a resource waits until its dependencies are Ready before it reconciles. Combined with wait: true (which makes a Kustomization Ready only when its workloads are healthy), this builds reliable chains — infrastructure (ingress, CRDs, cert-manager) becomes Ready first, then configuration, then apps. Flux will not roll the app layer until the infrastructure it needs is actually up.

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata: { name: apps, namespace: flux-system }
spec:
  dependsOn:
    - { name: infrastructure }      # wait until infrastructure is Ready
  interval: 10m
  sourceRef: { kind: GitRepository, name: fleet }
  path: ./apps
  prune: true
  wait: true

Health checks and readiness

Beyond wait, a Kustomization can declare explicit healthChecks — named resources it must see healthy before reporting Ready — which is how you gate on a specific Deployment or a custom resource (a Certificate being issued, an operator being up). This makes dependency chains robust: the config layer does not proceed until the specific thing it needs exists and is healthy, not merely applied. Accurate health gating is what prevents the ordering races that plague naive apply-everything approaches.

spec:
  wait: true
  healthChecks:
    - { kind: Deployment, name: cert-manager, namespace: cert-manager }
    - { apiVersion: apiextensions.k8s.io/v1, kind: CustomResourceDefinition, name: certificates.cert-manager.io }