wait until *cert manager* is ready

.gitlab/ci_scripts/install_zerossl_issuer.sh

 #!/usr/bin/env bash
 #
-# Waits until ClusterIssuer crd exists, and then installs a ZeroSSL
+# Waits until cert-manager HelmRelease is ready, and then installs a ZeroSSL
 # ClusterIssuer with our credentials into the cert-manager namespace
 #
 # Usage:
@@ -11,8 +11,8 @@ set -euo pipefail
 # Create secret with HMAC key
 kubectl -n cert-manager create secret generic zerossl-eabsecret --from-literal "secret=${ZEROSSL_EAB_HMAC_KEY}"
 
-# Wait until ClusterIssuer CRD exists
-"$(dirname "$0")/retry_cmd_until_success.sh" 30 10 kubectl get crd clusterissuers.cert-manager.io
+# Wait until cert-manager is ready
+"$(dirname "$0")/retry_cmd_until_success.sh" 30 10 "flux get helmrelease -n cert-manager --status-selector ready=true --no-header | grep cert-manager"
 
 # Add ZeroSSL ClusterIssuer
 kubectl apply -n cert-manager -f - <<EOF