Kubernetes Operator Quality Checklist

Use this checklist before major iterations, demos, releases, or code review sign-off.

Safety

• Target cluster is kind-* or another explicitly approved dev cluster.
• Leader election is disabled in the dev overlay.
• The dev manager runs a single replica.
• Webhook timeouts are short in dev.
• Mutations are limited to owned or explicitly allowed resources.
• Destructive operations require explicit confirmation.

CRD Quality

• Structural schema is valid and complete.
• Required fields are marked correctly.
• Sensible defaults exist for optional fields.
• Status subresource is enabled when status is used.
• Printer columns and categories improve operability.
• Validation markers enforce the stated invariants.

Webhook Quality

• Validating webhook covers invariants and immutable fields.
• Mutating webhook only defaults safe optional fields.
• Cross-field validation exists where needed.
• Error messages are clear.
• Failure policy matches the environment.
• Certificates, mounts, services, and endpoints are present.

RBAC Quality

• Verbs are minimal.
• Resources are minimal.
• Cluster-wide permissions are justified.
• Service accounts are dedicated.

Controller Quality

• Reconcile logic is idempotent.
• Owner references are set correctly.
• Finalizers exist for cleanup paths.
• Status conditions use standard concepts such as Ready, Progressing, and Degraded.
• Events are recorded for meaningful state changes.
• Transient failures requeue with backoff.

Fast Loop Quality

• make dev or tilt up starts cleanly.
• Local compile succeeds.
• Binary sync and restart work reliably.
• Logs reflect fresh code after edits.
• CRD and webhook changes are applied correctly.

Test Quality

• Reconcile logic has unit tests.
• Webhooks have envtest or integration coverage.
• Example CR manifests exist for manual checks.
• Error paths and edge cases are covered.