diff --git a/terraform/control-plane1.bu b/terraform/control-plane1.bu
index d32e1d6..c0866db 100644
--- a/terraform/control-plane1.bu
+++ b/terraform/control-plane1.bu
@@ -452,42 +452,40 @@ systemd:
         ConditionPathExists=!/var/lib/undercloud-stamps/install-ceph.done
 
         [Service]
+        Type=oneshot
+        Environment=KUBECONFIG=/etc/kubernetes/admin.conf
+        Environment=PATH=/usr/bin:/usr/sbin:/opt/bin
         StandardOutput=journal+console
         StandardError=journal+console
 
         ExecStart=/bin/sh -c 'echo "install.ceph.service started..."'
-        Environment=KUBECONFIG=/etc/kubernetes/admin.conf
-        Environment=DATASTORE_TYPE=kubernetes
-        Environment=PATH=/usr/bin/:/usr/sbin:/opt/bin
-        Type=oneshot
-        
-        StandardOutput=journal+console
-        StandardError=journal+console
-        ExecStart=/bin/sh -c 'echo "witing 30s..."'
-        ExecStart=/bin/sleep 30s
-        ExecStart=/bin/sh -c 'echo "create ceph namespace..."'
-        ExecStart=-/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/namespace.yaml
-        
-        ExecStart=-/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/csi-nodeplugin-rbac.yaml
-        ExecStart=-/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/csi-provisioner-rbac.yaml
+        ExecStart=/bin/sleep 30
 
-        ExecStart=-/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/secrets.yaml
+        ExecStart=/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/namespace.yaml
+        ExecStart=/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/csi-nodeplugin-rbac.yaml
+        ExecStart=/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/csi-provisioner-rbac.yaml
+        ExecStart=/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/secrets.yaml
+
+        # this must NOT be ignored
+        ExecStart=/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/ceph-conf.yaml
+
+        ExecStart=/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/csi-cephfsplugin-provisioner.yaml
+        ExecStart=/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/csi-cephfsplugin.yaml
+        ExecStart=/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/csi-config-map.yaml
+        ExecStart=/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/csi-encryption-kms-config.yaml
+        ExecStart=/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/csidriver.yaml
+        ExecStart=/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/storage-class.yaml
+
+        # readiness gates (only stamp if these succeed)
+        ExecStart=/opt/bin/kubectl -n ceph rollout status deploy/csi-cephfsplugin-provisioner --timeout=5m
+        ExecStart=/opt/bin/kubectl -n ceph rollout status ds/csi-cephfsplugin --timeout=5m
 
-        ExecStart=-/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/ceph-conf.yaml
-        ExecStart=-/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/csi-cephfsplugin-provisioner.yaml
-        ExecStart=-/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/csi-cephfsplugin.yaml
-        ExecStart=-/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/csi-config-map.yaml
-        ExecStart=-/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/csi-encryption-kms-config.yaml
-        
-        ExecStart=-/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/csidriver.yaml
-        
-        ExecStart=-/opt/bin/kubectl apply -f http://git.undercloud.local:3000/Undercloud/undercloud-infrastructure/raw/branch/main/ceph/storage-class.yaml
-        
         ExecStartPost=/usr/bin/touch /var/lib/undercloud-stamps/install-ceph.done
-        ExecStart=/usr/bin/systemctl disable install-ceph.service
-        #RemainAfterExit=true
+        ExecStartPost=-/usr/bin/systemctl disable install-ceph.service
+
         Restart=on-failure
         RestartSec=120s
+
         [Install]
         WantedBy=multi-user.target
     - name: install-gitea.service