How are you deploying Operators and resources dependent on them/CRDs?

[nmajin]

I am actually trying to deploy cert-manager as an Operator but getting errors installing the Issuer and Certificate Kinds, since the Operator is not yet installed (we handle the InstallPlan manually).

I am using Sync Waves and the argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true annotation on these objects, but still getting the Sync Failure since the Operator is not yet fully installed.

is there a way to do this that I am missing or could we have certain objects/manifests wait until their turn is ready? I assumed Sync Waves would take care of this but it doesn't seem to be doing it as well as I thought....the Subscription gets Synced and is healthy, so ArgoCD then moves onto the next Waves but technically its not ready.

[nastacio]

In our practice, we solve this with:

1. As you already noted, adding the argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true annotation to the resource
2. Adding argocd.argoproj.io/sync-wave annotations to both operator and resources, ensuring that the sync-wave for the operator is lower than the one for the resource.
3. Now this is important and what is missing in your environment: you need configure the custom resource health check for the operator: https://argo-cd.readthedocs.io/en/stable/operator-manual/health/#custom-health-checks

With these three settings in place, Argo will wait until the operator reports being ready before attempting to synchronize the resource.

Alternatively, if the custom resource health check is not an option, and this is not ideal, you could set the "retry" + "self-heal" option in the Application containing all resources. That way, the synchronization of the resource may fail a couple of times until the operator is ready, but will ultimately succeed.

spec:
  syncPolicy:
    automated:
      selfHeal: true

[nmajin]

Thanks for the reply and sorry for the long delay on responding. That 3rd bullet sounds like something that should already be implemented into the product, but I guess that is not the case. Any idea if someone already configured these? Seems a bit involved just to install cert-manager as an Operator via ArgoCD.

[nastacio]

That 3rd bullet sounds like something that should already be implemented into the product, but I guess that is not the case.

Products/components can contribute the health check for their resources, which is covered here:
https://argo-cd.readthedocs.io/en/stable/operator-manual/health/#way-2-contribute-a-custom-health-check

Any idea if someone already configured these?

I see 2 cert-manager folders in here, so it is possible. If you give it a try and it works, I am interested to know the results (I will need cert-manager in my repos soon.)