kubernetes-operatorlisted

# Build operators that reconcile correctly An operator is a reconcile loop, not a script. Most operator bugs are not Kubernetes bugs — they are reconcile-loop bugs: missing finalizers, blocking calls, no requeue on transient errors, status drift, RBAC over-grants. ## The reconcile mental model ``` observe(actual) → desired = read(spec) → diff(actual, desired) → act → update(status) ↓ requeue / done ``` **Idempotent, not imperative.** The reconcile function must be callable any number of times with the same outcome. It must not assume what happened on the previous call. ## Common operator bugs | Bug | Prevention | |-----|-----------| | Blocking HTTP calls in reconcile | Use async clients or move to a goroutine | | No requeue on transient error | Always `return ctrl.Result{}, err` for transient; `RequeueAfter` for polling | | Missing finalizer | Add finalizer on creation; remove only after cleanup complete | | Mutating spec instead of status | Spec is user-owned; status is controller-owned | | No status subresource | Status updates without subresource trigger spec reconcile → loop | | RBAC over-grant | Principle of least privilege; use `ClusterRole` only when namespace-scope is insufficient | | No leader election | Multi-replica deploy without leader election → split-brain | ## Operator capability levels (OLM) Level 1 (Basic install)