make ingress webhook reachable earlier by installing nginx-ingress earlier

closes #758

ansible/roles/apps/tasks/core.yml

@@ -96,6 +96,36 @@
     resource_definition: "{{ lookup('file', 'local-path-provisioner_hr.yaml') | from_yaml }}"
   when: "'local-path-provisioner' in enabled_applications"
 
+- name: Create Kubernetes secret with nginx-ingress settings
+  tags:
+    - config
+    - flux
+    - nginx
+  vars:
+    flux_secret:
+      name: "ingress"
+      namespace: "oas"
+  include_tasks:
+    file: flux_secret.yml
+    apply:
+      tags:
+        - config
+        - flux
+        - nginx
+
+# We have to install nginx-ingress before other charts so that the ingress
+# validation webhook exists before it is used.
+# It will still be managed by flux afterwards.
+- name: Create ingress HelmResource
+  tags:
+    - config
+    - flux
+    - nginx
+  k8s:
+    state: present
+    resource_definition: "{{ lookup('file', 'ingress_hr.yaml') | from_yaml }}"
+  when: "'ingress' in enabled_applications"
+
 - name: Install flux
   tags:
     - flux

ansible/roles/apps/tasks/main.yml

@@ -9,9 +9,6 @@
 - name: Tasks pertaining to letsencrypt
   import_tasks: letsencrypt.yml
 
-- name: Tasks pertaining to nginx
-  import_tasks: nginx.yml
-
 - name: Tasks pertaining to prometheus and grafana
   import_tasks: prometheus-stack.yml
 

ansible/roles/apps/tasks/nginx.yml

----
-
-- name: Create Kubernetes secret with nginx-ingress settings
-  tags:
-    - config
-    - flux
-    - nginx
-  vars:
-    flux_secret:
-      name: "ingress"
-      namespace: "oas"
-  include_tasks:
-    file: flux_secret.yml
-    apply:
-      tags:
-        - config
-        - flux
-        - nginx