fix(flux): vendor external-snapshotter manifests locally (stop remote-base build flake)

The kustomization pulled two REMOTE github bases (?ref=v8.2.0) that Flux's kustomize-controller
git-fetched on every reconcile; those fetches intermittently exceeded the 27s timeout ->
'kustomize build failed' BuildFailed events -> the whole platform tier stalled whenever GitHub was
slow. Vendored the exact v8.2.0 output to local crds.yaml + snapshot-controller.yaml (built with
kubectl kustomize; images transformer still re-pins the controller to v8.2.0), so the build is now
offline + deterministic. No change to what's deployed. platform/kubevirt has the same latent pattern.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/external-snapshotter/kustomization.yaml

@@ -29,17 +29,24 @@
 #   * The `client/config/crd` base also ships the beta VolumeGroupSnapshot CRDs; that feature is
 #     gated OFF in the controller (no --enable-volume-group-snapshots arg), so they are inert.
 #
-# Kustomize loads these as REMOTE bases (github.com/...?ref=<tag>) — the same remote-manifest
+# VENDORED (was remote github bases). The two upstream kustomize dirs are built to LOCAL files
-# pattern platform/kubevirt uses for the KubeVirt/CDI operators; Flux's kustomize-controller
+# (crds.yaml, snapshot-controller.yaml) at v8.2.0 and committed here. Previously these were REMOTE
-# fetches them identically at reconcile.
+# bases (github.com/...?ref=v8.2.0) that Flux's kustomize-controller `git fetch`ed on EVERY reconcile;
+# those fetches intermittently hit the controller's 27s timeout -> "kustomize build failed" -> the
+# WHOLE `platform` tier flaked (a transient GitHub slowness stalled every downstream app). Local files
+# make the build OFFLINE + deterministic. NOTE: platform/kubevirt still uses the same remote-base
+# pattern and carries the same latent fragility (vendor it too if it flakes).
+# RE-VENDOR on a version bump:
+#   kubectl kustomize "https://github.com/kubernetes-csi/external-snapshotter/client/config/crd?ref=vX.Y.Z" > crds.yaml
+#   kubectl kustomize "https://github.com/kubernetes-csi/external-snapshotter/deploy/kubernetes/snapshot-controller?ref=vX.Y.Z" > snapshot-controller.yaml
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  # renovate: datasource=github-releases depName=kubernetes-csi/external-snapshotter
+  - crds.yaml
-  - https://github.com/kubernetes-csi/external-snapshotter/client/config/crd?ref=v8.2.0
+  - snapshot-controller.yaml
-  # renovate: datasource=github-releases depName=kubernetes-csi/external-snapshotter
-  - https://github.com/kubernetes-csi/external-snapshotter/deploy/kubernetes/snapshot-controller?ref=v8.2.0
 images:
-  # Re-pin the controller image to the base ref so controller == CRD version (see header note).
+  # renovate: datasource=github-releases depName=kubernetes-csi/external-snapshotter
+  # Controller image == CRD version. A version bump = re-vendor crds.yaml + snapshot-controller.yaml
+  # at the new tag (see header) AND bump this newTag.
   - name: registry.k8s.io/sig-storage/snapshot-controller
     newTag: v8.2.0

platform/external-snapshotter/snapshot-controller.yaml

@@ -0,0 +1,200 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: snapshot-controller
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: snapshot-controller-leaderelection
+  namespace: kube-system
+rules:
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - watch
+  - list
+  - delete
+  - update
+  - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: snapshot-controller-runner
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - persistentvolumes
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - persistentvolumeclaims
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - list
+  - watch
+  - create
+  - update
+  - patch
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshotclasses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshotcontents
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - delete
+  - patch
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshotcontents/status
+  verbs:
+  - patch
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshots
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshots/status
+  verbs:
+  - update
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotclasses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotcontents
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - delete
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotcontents/status
+  verbs:
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshots
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshots/status
+  verbs:
+  - update
+  - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: snapshot-controller-leaderelection
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: snapshot-controller-leaderelection
+subjects:
+- kind: ServiceAccount
+  name: snapshot-controller
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: snapshot-controller-role
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: snapshot-controller-runner
+subjects:
+- kind: ServiceAccount
+  name: snapshot-controller
+  namespace: kube-system
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: snapshot-controller
+  namespace: kube-system
+spec:
+  minReadySeconds: 35
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: snapshot-controller
+  strategy:
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: snapshot-controller
+    spec:
+      containers:
+      - args:
+        - --v=5
+        - --leader-election=true
+        image: registry.k8s.io/sig-storage/snapshot-controller:v8.0.1
+        imagePullPolicy: IfNotPresent
+        name: snapshot-controller
+      serviceAccountName: snapshot-controller