istio: enforce base-first rollout and fix kustomize overlays

infrastructure/istio-base/base/kustomization.yaml

@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: cert-manager
 resources:
   - namespace.yaml
-  - helmrelease.yaml
+  - helmrelease.yaml

infrastructure/istio-gateway/base/helmrelease.yaml

@@ -5,6 +5,9 @@ metadata:
   namespace: istio-system
 spec:
   interval: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
   chart:
     spec:
       chart: istio-gateway-contour
@@ -19,4 +22,4 @@ spec:
       retries: 3
   upgrade:
     remediation:
-      retries: 3
+      retries: 3

infrastructure/istio-gateway/base/kustomization.yaml

@@ -1,6 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: cert-manager
 resources:
-  - namespace.yaml
-  - helmrelease.yaml
+  - helmrelease.yaml

infrastructure/istio-pilot/base/helmrelease.yaml

@@ -5,6 +5,9 @@ metadata:
   namespace: istio-system
 spec:
   interval: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
   chart:
     spec:
       chart: istiod-contour
@@ -19,4 +22,4 @@ spec:
       retries: 3
   upgrade:
     remediation:
-      retries: 3
+      retries: 3

infrastructure/istio-pilot/base/kustomization.yaml

@@ -1,6 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: cert-manager
 resources:
-  - namespace.yaml
-  - helmrelease.yaml
+  - helmrelease.yaml