Update install instructions for cert-manager managed Cilium Hubble TLS certificates

docs/modules/ROOT/pages/how-tos/cloudscale/decommission.adoc

@@ -52,6 +52,13 @@ include::partial$decommission-disable-syn.adoc[]
 kubectl delete svc --field-selector spec.type=LoadBalancer -A
 ----
 
+. Delete all loadbalancers
++
+[source,bash]
+----
+kubectl delete loadbalancers -A --all
+----
+
 . Delete all PVs
 +
 [source,bash]

docs/modules/ROOT/partials/install/bootstrap-nodes.adoc

@@ -124,6 +124,11 @@ kubectl patch -n cilium ciliumconfig cilium-enterprise --type=merge \
       },
       "hostPort": {
         "enabled": true
+      },
+      "hubble": {
+        "tls": {
+          "enabled": false
+        }
       }
     }
   }
@@ -150,7 +155,41 @@ terraform apply
 
 ifeval::["{provider}" == "cloudscale"]
 . Add the DNS records for etcd shown in output variable `dns_entries` from the previous step to the cluster's parent zone
+endif::[]
 
+. Wait for master nodes to become ready
++
+TIP: This is optional, but will make the subsequent steps less likely to run into weird timeouts.
++
+[source,bash]
+----
+kubectl wait --for condition=ready node -l node-role.kubernetes.io/master
+----
+
+. Deploy cert-manager
++
+[NOTE]
+====
+We need to deploy cert-manager early so we can use the cert-manager integration in the Cilium Helm chart.
+ifeval::["{provider}" == "cloudscale"]
+
+On cloudscale, we additionally need cert-manager in order to deploy the cloudscale-loadbalancer-controller.
+endif::[]
+====
++
+[source,bash]
+----
+kubectl apply -f ../cert-manager/00_namespace.yaml
+kubectl apply -Rf ../cert-manager/10_cert_manager
+kubectl -n syn-cert-manager patch --type=merge \
+  $(kubectl -n syn-cert-manager get deploy -oname) \
+  -p '{"spec":{"template":{"spec":{"tolerations":[{"operator":"Exists"}]}}}}'
+kubectl -n syn-cert-manager wait --for condition=available \
+  deploy cert-manager-webhook
+kubectl apply -f ../cilium/20_cilium_ca.yaml
+----
+
+ifeval::["{provider}" == "cloudscale"]
 . Apply the manifests for the cloudscale machine-api provider
 +
 [source,bash,subs="attributes+"]

docs/modules/ROOT/partials/install/prepare-syn-config.adoc

@@ -53,7 +53,6 @@ yq eval -i ".parameters.openshift4_version.spec.channel = \"fast-{ocp-minor-vers
 
 ifeval::["{provider}" == "cloudscale"]
 :is-terraform: yes
-:use-machine-api: yes
 endif::[]
 ifeval::["{provider}" == "exoscale"]
 :is-terraform: yes
@@ -65,9 +64,6 @@ endif::[]
 ifeval::["{is-terraform}" == "yes"]
 include::partial$install/prepare-syn-config-terraform.adoc[]
 endif::[]
-ifeval::["{use-machine-api}" == "yes"]
-include::partial$install/prepare-syn-config-machine-api.adoc[]
-endif::[]
 ifeval::["{provider}" == "vsphere"]
 include::partial$install/prepare-syn-config-vsphere.adoc[]
 endif::[]