From 469f3e907f27afbdae977836558f94b3481e60db Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Sun, 28 Jun 2026 06:20:15 +0000
Subject: [PATCH] fix: wait for ESO readiness before secret-plane resources

---
 scripts/src/platform-infra-secret-plane.ts | 23 +++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/scripts/src/platform-infra-secret-plane.ts b/scripts/src/platform-infra-secret-plane.ts
index a2b0245e..884102d1 100644
--- a/scripts/src/platform-infra-secret-plane.ts
+++ b/scripts/src/platform-infra-secret-plane.ts
@@ -716,6 +716,7 @@ ns_out="$tmp/ns.out"; ns_err="$tmp/ns.err"
 token_out="$tmp/token.out"; token_err="$tmp/token.err"
 eso_out="$tmp/eso.out"; eso_err="$tmp/eso.err"
 crd_out="$tmp/crd.out"; crd_err="$tmp/crd.err"
+eso_wait_out="$tmp/eso-wait.out"; eso_wait_err="$tmp/eso-wait.err"
 workload_out="$tmp/workload.out"; workload_err="$tmp/workload.err"
 kubectl create namespace ${target.namespace} --dry-run=client -o yaml | kubectl apply --server-side --force-conflicts --field-manager=${fieldManager} -f - >"$ns_out" 2>"$ns_err"
 ns_rc=$?
@@ -755,23 +756,30 @@ else
   printf '%s\\n' 'skipped because ESO manifest apply failed' >"$crd_err"
 fi
 if [ "$crd_rc" -eq 0 ]; then
+  kubectl -n ${target.namespace} wait --for=condition=available --timeout=${secretPlane.validation.timeoutSeconds}s deployment/${secretPlane.eso.controllerDeploymentName} deployment/${secretPlane.eso.webhookDeploymentName} deployment/${secretPlane.eso.certControllerDeploymentName} >"$eso_wait_out" 2>"$eso_wait_err"
+  eso_wait_rc=$?
+else
+  eso_wait_rc=1
+  printf '%s\\n' 'skipped because ESO CRDs are not established' >"$eso_wait_err"
+fi
+if [ "$eso_wait_rc" -eq 0 ]; then
   kubectl apply --server-side --force-conflicts --validate=false --field-manager=${fieldManager} -f "$workload" >"$workload_out" 2>"$workload_err"
   workload_rc=$?
 else
   workload_rc=1
-  printf '%s\\n' 'skipped because ESO CRDs are not established' >"$workload_err"
+  printf '%s\\n' 'skipped because ESO deployments are not available' >"$workload_err"
 fi
-python3 - "$ns_rc" "$token_rc" "$eso_rc" "$crd_rc" "$workload_rc" "$token_action" "$ns_out" "$ns_err" "$token_out" "$token_err" "$eso_out" "$eso_err" "$crd_out" "$crd_err" "$workload_out" "$workload_err" <<'PY'
+python3 - "$ns_rc" "$token_rc" "$eso_rc" "$crd_rc" "$eso_wait_rc" "$workload_rc" "$token_action" "$ns_out" "$ns_err" "$token_out" "$token_err" "$eso_out" "$eso_err" "$crd_out" "$crd_err" "$eso_wait_out" "$eso_wait_err" "$workload_out" "$workload_err" <<'PY'
 import json, sys
 def text(path, limit=1200):
     try:
         return open(path, encoding="utf-8", errors="replace").read()[-limit:]
     except FileNotFoundError:
         return ""
-ns_rc, token_rc, eso_rc, crd_rc, workload_rc = [int(value) for value in sys.argv[1:6]]
-paths = sys.argv[7:]
+ns_rc, token_rc, eso_rc, crd_rc, eso_wait_rc, workload_rc = [int(value) for value in sys.argv[1:7]]
+paths = sys.argv[8:]
 payload = {
-    "ok": ns_rc == 0 and token_rc == 0 and eso_rc == 0 and crd_rc == 0 and workload_rc == 0,
+    "ok": ns_rc == 0 and token_rc == 0 and eso_rc == 0 and crd_rc == 0 and eso_wait_rc == 0 and workload_rc == 0,
     "target": "${target.id}",
     "route": "${target.route}",
     "namespace": "${target.namespace}",
@@ -779,7 +787,7 @@ payload = {
     "secretMaterial": {
         "name": "${secretPlane.vault.tokenSecretName}",
         "key": "${secretPlane.vault.tokenSecretKey}",
-        "action": sys.argv[6],
+        "action": sys.argv[7],
         "valuesPrinted": False,
     },
     "steps": {
@@ -787,7 +795,8 @@ payload = {
         "tokenSecret": {"exitCode": token_rc, "stdoutTail": text(paths[2]), "stderrTail": text(paths[3]), "valuesPrinted": False},
         "externalSecretsOperator": {"exitCode": eso_rc, "stdoutTail": text(paths[4]), "stderrTail": text(paths[5])},
         "crdsEstablished": {"exitCode": crd_rc, "stdoutTail": text(paths[6]), "stderrTail": text(paths[7])},
-        "secretPlaneWorkload": {"exitCode": workload_rc, "stdoutTail": text(paths[8]), "stderrTail": text(paths[9])},
+        "esoDeploymentsReady": {"exitCode": eso_wait_rc, "stdoutTail": text(paths[8]), "stderrTail": text(paths[9])},
+        "secretPlaneWorkload": {"exitCode": workload_rc, "stdoutTail": text(paths[10]), "stderrTail": text(paths[11])},
     },
     "next": {
         "status": "bun scripts/cli.ts platform-infra secret-plane status --target ${target.id}",