valinor/kubernetes/apps/system/kubelet-csr-approver/app/helmrelease.yaml

---
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: kubelet-csr-approver
  namespace: system
spec:
  interval: 30m
  chart:
    spec:
      chart: kubelet-csr-approver
      version: 1.0.5
      sourceRef:
        kind: HelmRepository
        name: postfinance
        namespace: flux-system
      interval: 30m

  values:
    tolerations:
      # https://github.com/hetznercloud/hcloud-cloud-controller-manager
      # Allow HCCM itself to schedule on nodes that have not yet been initialized by HCCM.
      - key: "node.cloudprovider.kubernetes.io/uninitialized"
        value: "true"
        effect: "NoSchedule"
      - key: "CriticalAddonsOnly"
        operator: "Exists"

  valuesFrom:
    - kind: ConfigMap
      name: kubelet-csr-approver-values