Operator configuration

Every operator flag, its Helm value, and what happens when an optional integration is absent. Flags configure the operator once; per-app behavior lives in the WorkerApp resource.

Flags and Helm values

Each flag maps to a value under operator.* in the chart's values.yaml:

Flag	Helm value	Default	Purpose
`--ingress-mode`	`operator.ingressMode`	`httproute`	How hostnames are routed: `httproute` (Gateway API), `virtualservice` (classic Istio), `ingress` (`networking.k8s.io/v1`), or `none`. See ingress modes.
`--gateway-name`	`operator.gatewayName`	`edge`	Shared Gateway that HTTPRoutes attach to (`httproute` mode).
`--gateway-namespace`	`operator.gatewayNamespace`	`infra`	Namespace of that Gateway.
`--istio-gateways`	`operator.istioGateways`	unset	Pre-existing `networking.istio.io` Gateways (`namespace/name`, comma-separated) that VirtualServices bind to in `virtualservice` mode.
`--ingress-class`	`operator.ingressClass`	cluster default	IngressClass for `ingress` mode.
`--cluster-issuer`	`operator.clusterIssuer`	unset	cert-manager ClusterIssuer for `ingress` mode; when set, each app's Ingress requests its own TLS certificate. Drain-retry and WebSocket policies become ingress-nginx annotations in this mode (ignored by other controllers).
`--prometheus-url`	`operator.prometheusURL`	`http://prometheus-operated.monitoring.svc:9090`	Where KEDA queries the operator's `celld_*` metrics.
`--operator-namespace`	release namespace	`celld-operator-system`	Allowed by fleet NetworkPolicies to reach :8081.
`--operator-principal`	`operator.operatorPrincipal`	derived	Operator identity in Istio AuthorizationPolicies; empty derives `cluster.local/ns/<release ns>/sa/<service account>`.
`--state-poll-interval`	`operator.statePollInterval`	`15s`	`/state` polling cadence for metrics export and rollout gating.
`--deploy-poll-interval`	`operator.deployPollInterval`	`60s`	Bucket `deploy/current.json` polling cadence for `appVersion: auto` and version-mismatch detection.

Other chart values

Value	Default	Purpose
`controllerManager.replicas`	`1`	Manager replicas; leader election is on (`--leader-elect`).
`controllerManager.container.image.repository`	`ghcr.io/ezgamehost/celld-operator`	Operator image.
`controllerManager.container.image.tag`	`""`	Empty uses the chart's `appVersion`, the operator build the chart was released with.
`crd.enable`	`true`	Include the CRDs in the release.
`rbac.enable`	`true`	Include RBAC objects.

The manager runs non-root with a restricted security context, exposes health probes on :8081 (its own, not celld's) and metrics on :8443.

Graceful degradation

The operator requires none of its optional integrations to start reconciling. Absence is reported per-WorkerApp, not failed on:

Missing	Effect	Condition
Gateway API CRDs / implementation	Hostnames are not routed; fleet still serves in-cluster	`IngressReady: False`
Istio	NetworkPolicy alone guards :8081; no ambient mTLS	`MeshPolicyReady: False`
KEDA / Prometheus	`spec.autoscaling` has no effect; fleet runs at `spec.replicas`	`AutoscalingReady: False`

Store qualification tooling

The repository ships hack/cas-hammer, the concurrency probe for qualifying object stores:

$ go run ./hack/cas-hammer --bucket <bucket> --endpoint <url> --writers 8 --rounds 32

Development

$ make test     # envtest suite + unit tests
$ make lint     # golangci-lint
$ make run      # run against the current kubeconfig

Contributions are welcome; see CONTRIBUTING.md.