fix: stabilize v3 live release smokes

Author: mysticaltech

CHANGELOG.md

@@ -63,6 +63,8 @@ This is the v3 major-release line. Before upgrading from any `v2.x` release:
 
 ### 🐛 Bug Fixes
 
+- **External Manifest Fetch Resilience** - Added retry blocks to GitHub and public-IP HTTP data sources so transient TLS handshake timeouts do not fail plans, applies, or destroys.
+- **Autoscaler CA Root Loading** - Removed the `/etc/ssl/certs` hostPath mount from Cluster Autoscaler so RKE2/Leap Micro clusters use the image's bundled CA roots instead of hitting host certificate directory permission failures.
 - **Terraform 1.15 Validation Compatibility** - Moved cross-variable and local-dependent module contract checks from input-variable validation blocks into a hard `terraform_data.validation_contract` precondition surface, preserving plan-time failures while allowing Terraform 1.15.0 to initialize and validate the module.
 - **Tailscale Volume Provisioning Ordering** - Agent Longhorn and attached-volume configuration now waits for Tailscale agent bootstrap before using Tailnet MagicDNS SSH targets.
 - **Tailscale Auth-Key Ergonomics** - `auth_key` mode no longer advertises kube-hetzner tags by default, so simple pre-auth keys work without Tailnet `tagOwners`; tagged nodes remain an explicit opt-in and OAuth mode now validates that tag-scoped auth is configured.

data.tf

@@ -5,6 +5,12 @@ data "http" "hetzner_ccm_release" {
   request_headers = {
     Accept = "application/vnd.github+json"
   }
+
+  retry {
+    attempts     = 4
+    min_delay_ms = 1000
+    max_delay_ms = 10000
+  }
 }
 
 data "http" "hetzner_csi_release" {
@@ -14,6 +20,12 @@ data "http" "hetzner_csi_release" {
   request_headers = {
     Accept = "application/vnd.github+json"
   }
+
+  retry {
+    attempts     = 4
+    min_delay_ms = 1000
+    max_delay_ms = 10000
+  }
 }
 
 data "http" "kured_release" {
@@ -23,6 +35,12 @@ data "http" "kured_release" {
   request_headers = {
     Accept = "application/vnd.github+json"
   }
+
+  retry {
+    attempts     = 4
+    min_delay_ms = 1000
+    max_delay_ms = 10000
+  }
 }
 
 data "http" "kured_manifest" {
@@ -31,6 +49,12 @@ data "http" "kured_manifest" {
   request_headers = {
     Accept = "text/plain"
   }
+
+  retry {
+    attempts     = 4
+    min_delay_ms = 1000
+    max_delay_ms = 10000
+  }
 }
 
 data "http" "system_upgrade_controller_manifest" {
@@ -39,6 +63,12 @@ data "http" "system_upgrade_controller_manifest" {
   request_headers = {
     Accept = "text/plain"
   }
+
+  retry {
+    attempts     = 4
+    min_delay_ms = 1000
+    max_delay_ms = 10000
+  }
 }
 
 data "http" "system_upgrade_controller_crd" {
@@ -47,6 +77,12 @@ data "http" "system_upgrade_controller_crd" {
   request_headers = {
     Accept = "text/plain"
   }
+
+  retry {
+    attempts     = 4
+    min_delay_ms = 1000
+    max_delay_ms = 10000
+  }
 }
 
 data "http" "gateway_api_standard_crds" {
@@ -57,6 +93,12 @@ data "http" "gateway_api_standard_crds" {
   request_headers = {
     Accept = "text/plain"
   }
+
+  retry {
+    attempts     = 4
+    min_delay_ms = 1000
+    max_delay_ms = 10000
+  }
 }
 
 data "http" "calico_release" {
@@ -66,6 +108,12 @@ data "http" "calico_release" {
   request_headers = {
     Accept = "application/vnd.github+json"
   }
+
+  retry {
+    attempts     = 4
+    min_delay_ms = 1000
+    max_delay_ms = 10000
+  }
 }
 
 data "hcloud_ssh_keys" "keys_by_selector" {
@@ -81,6 +129,12 @@ data "http" "my_ipv4" {
   request_headers = {
     Accept = "text/plain"
   }
+
+  retry {
+    attempts     = 4
+    min_delay_ms = 1000
+    max_delay_ms = 10000
+  }
 }
 
 data "hcloud_servers" "existing_control_plane_nodes" {

templates/autoscaler.yaml.tpl

@@ -228,12 +228,4 @@ ${indent(8, yamlencode(cluster_autoscaler_tolerations))}
           - name: HCLOUD_SERVER_CREATION_TIMEOUT
             value: '${cluster_autoscaler_server_creation_timeout}'
           %{~ endif ~}
-          volumeMounts:
-            - name: ssl-certs
-              mountPath: /etc/ssl/certs
-              readOnly: true
           imagePullPolicy: "Always"
-      volumes:
-        - name: ssl-certs
-          hostPath:
-            path: "/etc/ssl/certs" # right place on MicroOS?