This message was deleted.

I've got this (untested) but wondering if there's a more obvious / simpler way

await new Promise<boolean>(async (resolve) => {
        const webhookStatus = certManager.getResourceProperty("apps/v1/Deployment", "cert-manager/cert-manager-webhook", "status");
        const sleep = () => new Promise(resolve => setTimeout(resolve, 1000));

        let count = 0;
        while (count < 120) {
            webhookStatus.availableReplicas.apply(replicas => { if (replicas > 0) resolve(true); });
            await sleep();
            count++;
        }
        resolve(false);
    });

Usually, the solution is to use a liveness/readiness probe defined on the k8s resource itself. With that defined, k8s won’t report the resource ready until the webhook responds, which means Pulumi also won’t report it ready until that happens.

will that work against an admission webhook though? afaict there's no direct link between a resource that a webhook can reject so i'm still not sure how i'd wait to try and deploy it