title: In CDK, can I wait until a Helm-installed operator is running before applying a manifest?
body: <p>I'm installing the External Secrets Operator alongside Apache Pinot into an EKS cluster using CDK. I'm running into an issue that I think is being caused by CDK attempting to create a resource defined by the ESO before the ESO has actually gotten up and running. Here's the relevant code:</p>
  <pre class="lang-js prettyprint-override"><code>// install Pinot
  const pinot = cluster.addHelmChart('Pinot', {
      chartAsset: new Asset(this, 'PinotChartAsset', { path: path.join(__dirname, '../pinot') }),
      release: 'pinot',
      namespace: 'pinot',
      createNamespace: true
  });
  
  
  // install the External Secrets Operator
  const externalSecretsOperator = cluster.addHelmChart('ExternalSecretsOperator', {
      chart: 'external-secrets',
      release: 'external-secrets',
      repository: 'https://charts.external-secrets.io',
      namespace: 'external-secrets',
      createNamespace: true,
      values: {
          installCRDs: true,
          webhook: {
              port: 9443
          }
      }
  });
  
  
  // create a Fargate Profile
  const fargateProfile = cluster.addFargateProfile('FargateProfile', {
      fargateProfileName: 'externalsecrets',
      selectors: [{ 'namespace': 'external-secrets' }]
  });
  
  
  // create the Service Account used by the Secret Store
  const serviceAccount = cluster.addServiceAccount('ServiceAccount', {
      name: 'eso-service-account',
      namespace: 'external-secrets'
  });
  serviceAccount.addToPrincipalPolicy(new iam.PolicyStatement({
      effect: iam.Effect.ALLOW,
      actions: [
          'secretsmanager:GetSecretValue',
          'secretsmanager:DescribeSecret'
      ],
      resources: [
          'arn:aws:secretsmanager:us-east-1:&lt;MY-ACCOUNT-ID&gt;:secret:*'
      ]
  }))
  serviceAccount.node.addDependency(externalSecretsOperator);
  
  
  // create the Secret Store, an ESO Resource
  const secretStoreManifest = getSecretStoreManifest(serviceAccount);
  const secretStore = cluster.addManifest('SecretStore', secretStoreManifest);
  secretStore.node.addDependency(serviceAccount);
  secretStore.node.addDependency(fargateProfile);
  
  
  // create the External Secret, another ESO resource
  const externalSecretManifest = getExternalSecretManifest(secretStoreManifest)
  const externalSecret = cluster.addManifest('ExternalSecret', externalSecretManifest)
  externalSecret.node.addDependency(secretStore);
  externalSecret.node.addDependency(pinot);
  </code></pre>
  <p>Even though I've set the ESO as a dependency to the Secret Store, when I try to deploy this I get the following error:</p>
  <pre><code>Received response status [FAILED] from custom resource. Message returned: Error: b'Error from server (InternalError): error when creating &quot;/tmp/manifest.yaml&quot;: Internal error occurred:
  failed calling webhook &quot;validate.clustersecretstore.external-secrets.io&quot;: Post &quot;https://external-secrets-webhook.external-secrets.svc:443/validate-external-secrets-io-v1beta1-clusterse
  cretstore?timeout=5s&quot;: no endpoints available for service &quot;external-secrets-webhook&quot;\n'
  </code></pre>
  <p>If I understand correctly, this is the error you'd get if you try to add a Secret Store before the ESO is fully installed. I'm guessing that CDK does not wait until the ESO's pods are running before attempting to apply the manifest. Furthermore, if I comment out the lines the create the Secret Store and External Secret, do a <code>cdk deploy</code>, uncomment those lines and then deploy again, everything works fine.</p>
  <p>Is there any way around this? Some way I can retry applying the manifest, or to wait a period of time before attempting the apply?</p>