fix(cert-manager): add bootstrap_mode_enabled to fix SLA-3 spinup

During SLA-3 bootstrap, cert-manager webhook requires instance-type
anti-affinity (2 pods on different instance types), but only the EKS
controller node group exists until Karpenter deploys at step 10.
This leaves webhook pods Pending indefinitely, blocking bootstrap.

Add bootstrap_mode_enabled to kube_certificates and kube_cert_manager,
following the same two-phase pattern used for Vault (commit 4b2379c):
- Phase 1 (setupCertificates): deploy with bootstrap_mode_enabled=true
  to disable webhook anti-affinity so pods schedule on controller nodes
- Phase 2 (setupClusterExtensions): flip to false after Karpenter and
  node pools are available to restore proper pod spread

No behavior change for SLA-1 or SLA-2 clusters.

Author: fullykubed

bun.lock

@@ -9,6 +9,7 @@
     "check-dependency-version-consistency": "4.1.0"
   },
   "dependencies": {
+    "typescript": "5.6.2",
     "yaml": "2.7.1"
   }
-}
+}

package.json

@@ -135,6 +135,10 @@ export async function setupCertificates(
             module: MODULES.KUBE_CERTIFICATES,
             hclIfMissing: await Bun.file(kubeCertificatesTemplate).text(),
             inputUpdates: {
+              bootstrap_mode_enabled: defineInputUpdate({
+                schema: z.boolean(),
+                update: () => true,
+              }),
               self_generated_certs_enabled: defineInputUpdate({
                 schema: z.boolean(),
                 update: () => true,

packages/cli/bun.lock

@@ -88,6 +88,30 @@ export async function setupClusterExtensions(
     );
   }
 
+  const shouldSkipCertManagerAntiAffinityAdjustment = async () => {
+    const certManagerModuleInfo = await readYAMLFile({
+      filePath: join(clusterPath, MODULES.KUBE_CERTIFICATES, "module.yaml"),
+      context,
+      validationSchema: z.object({
+        extra_inputs: z.object({
+          bootstrap_mode_enabled: z.boolean(),
+        }),
+      }),
+    });
+
+    const certManagerPfData = await getModuleStatus({
+      environment,
+      region,
+      module: MODULES.KUBE_CERTIFICATES,
+      context,
+    });
+
+    return (
+      certManagerPfData.deploy_status === "success" &&
+      certManagerModuleInfo?.extra_inputs?.bootstrap_mode_enabled === false
+    );
+  };
+
   interface IContext {
     vaultProxyPid?: number;
     vaultProxyPort?: number;
@@ -280,6 +304,23 @@ export async function setupClusterExtensions(
                 }),
               },
             }),
+            await buildDeployModuleTask({
+              taskTitle: "Cert-Manager Anti-Affinity Adjustment",
+              context,
+              env: {
+                ...process.env,
+              },
+              environment,
+              region,
+              skipIfAlreadyApplied: await shouldSkipCertManagerAntiAffinityAdjustment(),
+              module: MODULES.KUBE_CERTIFICATES,
+              inputUpdates: {
+                bootstrap_mode_enabled: defineInputUpdate({
+                  schema: z.boolean(),
+                  update: () => false,
+                }),
+              },
+            }),
           ],
           { ctx, concurrent: true }
         );

packages/cli/bun.nix

@@ -50,4 +50,4 @@
   },
   "include": ["src/**/*"],
   "exclude": ["node_modules", "dist", "bin", "build.config.ts"]
-}
+}

packages/cli/src/commands/cluster/add/setupCertificates.ts

@@ -53,7 +53,7 @@ module "util_webhook" {
   source = "../kube_workload_utility"
 
   workload_name                        = "cert-manager-webhook"
-  instance_type_anti_affinity_required = var.sla_target == 3
+  instance_type_anti_affinity_required = var.bootstrap_mode_enabled ? false : var.sla_target == 3
   az_spread_preferred                  = var.sla_target >= 2
   host_anti_affinity_required          = var.sla_target >= 2
   panfactum_scheduler_enabled          = var.panfactum_scheduler_enabled

packages/cli/src/commands/cluster/add/setupClusterExtensions.ts

@@ -79,4 +79,10 @@ variable "controller_nodes_enabled" {
   description = "Whether to allow pods to schedule on EKS Node Group nodes (controller nodes)"
   type        = bool
   default     = true
+}
+
+variable "bootstrap_mode_enabled" {
+  description = "Whether the cluster is being bootstrapped and does not yet have the autoscaler enabled"
+  type        = bool
+  default     = false
 }

packages/cli/tsconfig.json

@@ -113,7 +113,7 @@ module "util_webhook" {
   source = "../kube_workload_utility"
 
   workload_name                        = "cert-manager-webhook"
-  instance_type_anti_affinity_required = var.sla_target == 3
+  instance_type_anti_affinity_required = var.bootstrap_mode_enabled ? false : var.sla_target == 3
   az_spread_preferred                  = var.sla_target >= 2
   host_anti_affinity_required          = var.sla_target >= 2
   panfactum_scheduler_enabled          = var.panfactum_scheduler_enabled