Summary
Currently, deploying the Rancher Backup Operator requires two separate Helm releases installed in strict order:
helm install rancher-backup-crd # must come first
helm install rancher-backup # fails if CRDs are absent
This is caused by validate-install-crd.yaml which uses lookup() at template render time to verify CRD existence. Since lookup() runs during rendering — before any resources are applied — the CRDs must already be in the cluster when helm install rancher-backup is invoked.
Proposed change
Move the CRD manifests from charts/rancher-backup-crd/templates/ into a crds/ directory at the root of the rancher-backup chart:
rancher-backup/
crds/
backup.yaml ← moved from rancher-backup-crd/templates/
resourceset.yaml
restore.yaml
templates/
validate-install-crd.yaml ← can be removed (CRDs guaranteed present)
Helm installs resources in crds/ before rendering any templates (Helm docs — Custom Resource Definitions). This means:
CRDs are applied first
Templates are rendered — lookup() finds the CRDs → no error
Remaining resources are applied
The validate-install-crd.yaml pre-check becomes redundant and can be removed.
Impact
Single helm install rancher-backup — no separate CRD release needed
rancher-backup-crd chart can be deprecated
Simplifies GitOps pipelines and CAPI Addons setups where ordering between HelmChartProxy resources is not guaranteed
Summary
Currently, deploying the Rancher Backup Operator requires two separate Helm releases installed in strict order:
helm install rancher-backup-crd # must come first
helm install rancher-backup # fails if CRDs are absent
This is caused by validate-install-crd.yaml which uses lookup() at template render time to verify CRD existence. Since lookup() runs during rendering — before any resources are applied — the CRDs must already be in the cluster when helm install rancher-backup is invoked.
Proposed change
Move the CRD manifests from charts/rancher-backup-crd/templates/ into a crds/ directory at the root of the rancher-backup chart:
Helm installs resources in crds/ before rendering any templates (Helm docs — Custom Resource Definitions). This means:
CRDs are applied first
Templates are rendered — lookup() finds the CRDs → no error
Remaining resources are applied
The validate-install-crd.yaml pre-check becomes redundant and can be removed.
Impact
Single helm install rancher-backup — no separate CRD release needed
rancher-backup-crd chart can be deprecated
Simplifies GitOps pipelines and CAPI Addons setups where ordering between HelmChartProxy resources is not guaranteed