fix: resolve cert-manager CRD dependency for cluster redeployability

- Add root kustomization.yaml to explicitly list included paths
- Exclude cert-manager and cert-manager-issuer from root kustomization
- Add Flux Kustomizations in system/flux/ to manage deployment order
- cert-manager Flux Kustomization includes health checks for CRDs
- cert-manager-issuer depends on cert-manager being ready

kubernetes/system/cert-manager-issuer/kustomization.yaml

@@ -0,0 +1,5 @@
+# ClusterIssuer resources for cert-manager
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - clusterissuer.yaml

kubernetes/system/cert-manager/kustomization.yaml

@@ -6,7 +6,6 @@ resources:
   - repository.yaml
   - release.yaml
   - cloudflare-api-token-secret.yaml
-  - clusterissuer.yaml
 secretGenerator:
   - name: cert-manager-values
     files:

kubernetes/system/flux/cert-manager-issuer.yaml

@@ -0,0 +1,19 @@
+# Flux Kustomization for cert-manager ClusterIssuer
+# Depends on cert-manager being fully operational (CRDs installed)
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager-issuer
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/system/cert-manager-issuer
+  dependsOn:
+    - name: cert-manager
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops

kubernetes/system/flux/cert-manager.yaml

@@ -0,0 +1,31 @@
+# Flux Kustomization for cert-manager
+# Separate from main homeprod because cert-manager CRDs must be installed
+# before ClusterIssuer resources can be applied
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/system/cert-manager
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: cert-manager
+      namespace: cert-manager
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: cert-manager-webhook
+      namespace: cert-manager
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: cert-manager-cainjector
+      namespace: cert-manager

kubernetes/system/flux/kustomization.yaml

@@ -0,0 +1,8 @@
+# Flux system resources
+# Contains Flux Kustomization resources for additional dependencies
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - webhook.yaml
+  - cert-manager.yaml
+  - cert-manager-issuer.yaml