Crds first

[gianlucam76]

When a PolicyRef (including remoteURL pointing at an OCI image) contains both CustomResourceDefinitions and custom resources that depend on them, Sveltos deploys objects in the order they appear in the manifest. If a CR precedes its CRD in the file, the CR fails to apply because the type isn't registered yet. Without continueOnError, that failure aborts the deployment before the CRD (which appears later in the same file) is ever applied. Every retry replays the same order and fails the same way, so a new cluster never progresses past that object.

Unlike kustomizationRefs, where the resources: list in a kustomization.yaml already gives users an explicit way to order the CRD before its CRs, policyRefs sources (ConfigMap, Secret, GitRepository, OCIRepository, Bucket, remoteURL) offer no such mechanism. The author has no lever to fix ordering inside a third-party manifest.

Add partitionCRDsFirst, a stable partition that moves every CustomResourceDefinition ahead of other resources while preserving relative order within each group. It's called once in deployContent, right after patches are applied and before the push/pull-mode branch, so it covers every policyRefs source for both push-mode (deployUnstructured) and pull-mode (pullmode.StageResourcesForDeployment) clusters, since both consume the same ordered list.

It's a no-op whenever CRDs already come first or none are present. kustomizationRefs is intentionally left untouched, with a comment explaining why.