diff --git a/.github/workflows/ci-operator.yml b/.github/workflows/ci-operator.yml
index 980c7c1d..f607984a 100644
--- a/.github/workflows/ci-operator.yml
+++ b/.github/workflows/ci-operator.yml
@@ -6,7 +6,7 @@ name: CI · Operator
 
 on:
   push:
-    branches: [main]
+    branches: [main, operator]
   pull_request:
     branches: [main]
 
@@ -44,6 +44,7 @@ jobs:
               - 'charts/kates/**'
               - 'charts/kafka-cluster/**'
               - 'config/cluster.yaml'
+              - 'scripts/deploy-kafka-generic.sh'
               - 'versions.env'
               - '.github/workflows/ci-operator.yml'
 
@@ -84,11 +85,11 @@ jobs:
 
       - name: Generated CRDs are fresh
         run: |
-          cargo run --locked --bin crdgen -- --out crds
-          if [ -n "$(git status --porcelain crds)" ]; then
-            git status --porcelain crds
-            git diff crds
-            echo "::error::operator/crds is stale: run cargo run --bin crdgen -- --out crds"
+          cargo run --locked --bin crdgen -- --out chart/crds
+          if [ -n "$(git status --porcelain chart/crds)" ]; then
+            git status --porcelain chart/crds
+            git diff chart/crds
+            echo "::error::operator/chart/crds is stale: run cargo run --bin crdgen -- --out chart/crds"
             exit 1
           fi
 
@@ -108,7 +109,7 @@ jobs:
           set -euo pipefail
           schemas="${RUNNER_TEMP}/schemas"
           mkdir -p "${schemas}"
-          yq -o=json '.spec.versions[0].schema.openAPIV3Schema' operator/crds/katestests.kates.io.yaml \
+          yq -o=json '.spec.versions[0].schema.openAPIV3Schema' operator/chart/crds/katestests.kates.io.yaml \
             | jq '.properties.spec |= walk(if type == "object" and (.properties | type) == "object"
                                            then . + {additionalProperties: false} else . end)' \
             > "${schemas}/katestest_v1alpha1.json"
@@ -123,15 +124,29 @@ jobs:
           fi
 
   e2e:
-    name: CRDs on Kind
+    name: E2E on Kind
     needs: changes
     if: needs.changes.outputs.e2e == 'true'
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/load-versions
 
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      # deploy-kafka-generic.sh detects the cluster with it.
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: cli/go.mod
+          cache-dependency-path: cli/go.sum
+
+      - name: Build kates CLI
+        working-directory: cli
+        run: go build -o ../build/kates .
+
       # node_image is deliberately not passed, as in integration.yml:
       # config/cluster.yaml names the image.
       - name: Create Kind cluster
@@ -146,7 +161,25 @@ jobs:
       # The apiserver is the only CEL compiler, cost and oldSelf-correlatability
       # checker there is.
       - name: The apiserver accepts the CRDs
-        run: kubectl apply --dry-run=server -f operator/crds
+        run: kubectl apply --dry-run=server -f operator/chart/crds
+
+      - name: Build the operator image
+        run: |
+          docker build -f operator/Dockerfile -t kates-operator:ci .
+          kind load docker-image kates-operator:ci --name ci-test
+
+      - name: Deploy Kafka, Kates and the operator
+        run: operator/e2e-stack.sh docker.io/library/kates-operator:ci
+
+      - name: Run the e2e checks
+        run: operator/e2e.sh payments kafka krafter
+
+      - name: Show the stack
+        if: failure()
+        run: |
+          kubectl get pods -A
+          kubectl -n kates logs deploy/kates -c kates --tail=50 || true
+          kubectl -n kates-operator logs deploy/kates-operator --tail=50 || true
 
   gate:
     name: Gate · Operator
diff --git a/.github/workflows/publish-operator.yml b/.github/workflows/publish-operator.yml
new file mode 100644
index 00000000..7507bbfe
--- /dev/null
+++ b/.github/workflows/publish-operator.yml
@@ -0,0 +1,133 @@
+name: Publish · Operator
+
+# The operator's image and chart, on an operator-v<version> tag. It lives apart
+# from release.yml on purpose: the operator ships on its own versions, and a
+# v* Kates release never sees it.
+
+on:
+  push:
+    tags:
+      - "operator-v*"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-operator-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  IMAGE: ghcr.io/bmscomp/kates-operator
+  CHART_REGISTRY: oci://ghcr.io/bmscomp/charts
+  # github.ref, so a signature names this tag, as publish-charts.yml's do.
+  IDENTITY: https://github.com/${{ github.repository }}/.github/workflows/publish-operator.yml@${{ github.ref }}
+  ISSUER: https://token.actions.githubusercontent.com
+
+jobs:
+  check:
+    name: Tag matches the chart
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - id: version
+        run: |
+          set -euo pipefail
+          version=${GITHUB_REF_NAME#operator-v}
+          chart=$(yq .version operator/chart/Chart.yaml)
+          app=$(yq .appVersion operator/chart/Chart.yaml)
+          if [ "${version}" != "${chart}" ] || [ "${version}" != "${app}" ]; then
+            echo "::error::tag ${version}, chart ${chart}, appVersion ${app}: all three must match"
+            exit 1
+          fi
+          echo "version=${version}" >> "${GITHUB_OUTPUT}"
+
+  build:
+    name: Build (${{ matrix.arch }})
+    needs: check
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        include:
+          - {arch: amd64, runner: ubuntu-latest}
+          - {arch: arm64, runner: ubuntu-24.04-arm}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: operator/Dockerfile
+          platforms: linux/${{ matrix.arch }}
+          push: true
+          tags: ${{ env.IMAGE }}:sha-${{ github.sha }}-${{ matrix.arch }}
+          provenance: mode=max
+          sbom: true
+
+  publish:
+    name: Merge, sign, push the chart
+    needs: [check, build]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      packages: write
+      id-token: write # cosign keyless signing
+    env:
+      VERSION: ${{ needs.check.outputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/load-versions
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+        with:
+          version: ${{ env.HELM_VERSION }}
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Helm logs in
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: helm registry login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin <<<"${TOKEN}"
+
+      - name: Merge and sign the image
+        run: |
+          set -euo pipefail
+          docker buildx imagetools create -t "${IMAGE}:${VERSION}" \
+            "${IMAGE}:sha-${GITHUB_SHA}-amd64" "${IMAGE}:sha-${GITHUB_SHA}-arm64"
+          digest=$(docker buildx imagetools inspect "${IMAGE}:${VERSION}" --format '{{json .Manifest.Digest}}' | tr -d '"')
+          cosign sign --yes "${IMAGE}@${digest}"
+          cosign verify "${IMAGE}@${digest}" --certificate-identity "${IDENTITY}" \
+            --certificate-oidc-issuer "${ISSUER}" > /dev/null
+
+      - name: Push and sign the chart
+        run: |
+          set -euo pipefail
+          # helm package is not reproducible: a re-run would replace a digest
+          # someone may already pin, so a published version is never pushed again.
+          if helm show chart "${CHART_REGISTRY}/kates-operator" --version "${VERSION}" > /dev/null 2>&1; then
+            echo "kates-operator ${VERSION} is already published"
+            exit 0
+          fi
+          helm package operator/chart --destination .build/
+          out=$(helm push ".build/kates-operator-${VERSION}.tgz" "${CHART_REGISTRY}" 2>&1)
+          echo "${out}"
+          digest=$(sed -n 's/^Digest: //p' <<<"${out}")
+          repo=ghcr.io/bmscomp/charts/kates-operator
+          cosign sign --yes "${repo}@${digest}"
+          cosign verify "${repo}@${digest}" --certificate-identity "${IDENTITY}" \
+            --certificate-oidc-issuer "${ISSUER}" > /dev/null
diff --git a/operator/Cargo.lock b/operator/Cargo.lock
index e767c582..f49477f6 100644
--- a/operator/Cargo.lock
+++ b/operator/Cargo.lock
@@ -73,6 +73,12 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
 [[package]]
 name = "ar_archive_writer"
 version = "0.5.3"
@@ -88,6 +94,16 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
 
+[[package]]
+name = "assert-json-diff"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e4f2b81832e72834d7518d8487a0396a28cc408186a2e8854c0f98011faf12"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "async-broadcast"
 version = "0.7.2"
@@ -122,6 +138,17 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "async-trait"
+version = "0.1.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
@@ -157,6 +184,52 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "sync_wrapper",
+ "tokio",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+]
+
 [[package]]
 name = "backon"
 version = "1.6.0"
@@ -265,6 +338,23 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
 
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.45"
@@ -318,6 +408,15 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
 
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "darling"
 version = "0.24.1"
@@ -352,6 +451,24 @@ dependencies = [
  "syn 3.0.9",
 ]
 
+[[package]]
+name = "deadpool"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0be2b1d1d6ec8d846f05e137292d0b89133caf95ef33695424c09568bdd39b1b"
+dependencies = [
+ "deadpool-runtime",
+ "lazy_static",
+ "num_cpus",
+ "tokio",
+]
+
+[[package]]
+name = "deadpool-runtime"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "092966b41edc516079bdf31ec78a2e0588d1d0c08f78b91d8307215928642b2b"
+
 [[package]]
 name = "defmt"
 version = "1.2.0"
@@ -415,6 +532,12 @@ dependencies = [
  "syn 3.0.9",
 ]
 
+[[package]]
+name = "dtoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
+
 [[package]]
 name = "dunce"
 version = "1.0.5"
@@ -536,6 +659,12 @@ version = "0.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c66915cc5391097de7a2b0b972e8505aa33c0df401fd3a6811dbdb32881ba48"
 
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
 [[package]]
 name = "foldhash"
 version = "0.2.0"
@@ -565,6 +694,7 @@ checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
 dependencies = [
  "futures-channel",
  "futures-core",
+ "futures-executor",
  "futures-io",
  "futures-sink",
  "futures-task",
@@ -587,6 +717,17 @@ version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
 
+[[package]]
+name = "futures-executor"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
 [[package]]
 name = "futures-io"
 version = "0.3.34"
@@ -640,8 +781,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "wasi",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -663,8 +806,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 6.0.0",
+ "rand_core 0.10.1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -689,6 +835,25 @@ dependencies = [
  "smallvec",
 ]
 
+[[package]]
+name = "h2"
+version = "0.4.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
@@ -700,6 +865,18 @@ dependencies = [
  "foldhash",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "hermit-abi"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17592d60ebacc7d5e169f4663c5f84f9161cc90328abcfe8456f41e4dfcb284"
+
 [[package]]
 name = "hostname"
 version = "0.4.2"
@@ -750,6 +927,12 @@ version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
 [[package]]
 name = "hyper"
 version = "1.12.0"
@@ -758,10 +941,13 @@ checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c"
 dependencies = [
  "atomic-waker",
  "bytes",
+ "futures-channel",
  "futures-core",
+ "h2",
  "http",
  "http-body",
  "httparse",
+ "httpdate",
  "itoa",
  "pin-project-lite",
  "smallvec",
@@ -805,6 +991,7 @@ version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
 dependencies = [
+ "base64 0.23.1",
  "bytes",
  "futures-channel",
  "futures-util",
@@ -812,7 +999,9 @@ dependencies = [
  "http-body",
  "httparse",
  "hyper",
+ "ipnet",
  "libc",
+ "percent-encoding",
  "pin-project-lite",
  "socket2",
  "tokio",
@@ -954,12 +1143,31 @@ dependencies = [
  "icu_properties",
 ]
 
+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+]
+
 [[package]]
 name = "ipnet"
 version = "2.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.18"
@@ -975,10 +1183,12 @@ dependencies = [
  "defmt",
  "jiff-core",
  "jiff-static",
+ "jiff-tzdb-platform",
  "log",
  "portable-atomic",
  "portable-atomic-util",
  "serde_core",
+ "windows-link",
 ]
 
 [[package]]
@@ -1003,6 +1213,21 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "jiff-tzdb"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa8377070c6bae868759445e5a77f66d84f0b72f3a054bfb00e6d038b8282da7"
+
+[[package]]
+name = "jiff-tzdb-platform"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "875a5a69ac2bab1a891711cf5eccbec1ce0341ea805560dcd90b7a2e925132e8"
+dependencies = [
+ "jiff-tzdb",
+]
+
 [[package]]
 name = "jni"
 version = "0.22.4"
@@ -1121,6 +1346,19 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "kates-client"
+version = "0.1.0"
+dependencies = [
+ "reqwest",
+ "secrecy",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.21",
+ "tokio",
+ "wiremock",
+]
+
 [[package]]
 name = "kates-crds"
 version = "0.1.0"
@@ -1133,6 +1371,36 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "kates-operator"
+version = "0.1.0"
+dependencies = [
+ "axum",
+ "futures",
+ "http",
+ "jiff",
+ "json-patch",
+ "k8s-openapi",
+ "kates-client",
+ "kates-crds",
+ "kube",
+ "kube-lease-manager",
+ "opentelemetry",
+ "opentelemetry-otlp",
+ "opentelemetry_sdk",
+ "prometheus-client",
+ "rustls",
+ "secrecy",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.21",
+ "tokio",
+ "tower-test",
+ "tracing",
+ "tracing-opentelemetry",
+ "tracing-subscriber",
+]
+
 [[package]]
 name = "kube"
 version = "5.0.0"
@@ -1196,7 +1464,7 @@ dependencies = [
  "tokio",
  "tokio-util",
  "tower",
- "tower-http",
+ "tower-http 0.7.1",
  "tracing",
 ]
 
@@ -1234,6 +1502,20 @@ dependencies = [
  "syn 3.0.9",
 ]
 
+[[package]]
+name = "kube-lease-manager"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d0763a568229d7e0e6adb359bbc898e809898ccda81946a085c7238fc0e6c99"
+dependencies = [
+ "k8s-openapi",
+ "kube",
+ "rand 0.10.3",
+ "thiserror 2.0.21",
+ "tokio",
+ "tracing",
+]
+
 [[package]]
 name = "kube-runtime"
 version = "5.0.0"
@@ -1246,7 +1528,7 @@ dependencies = [
  "backon",
  "educe",
  "futures",
- "hashbrown",
+ "hashbrown 0.16.1",
  "hostname",
  "json-patch",
  "k8s-openapi",
@@ -1294,6 +1576,27 @@ version = "0.4.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d15f86d12da44cd8d4ec3c73984537eb7f4cadcb9776a575a0a8a05ca11005c"
 
+[[package]]
+name = "lru-slab"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4050469837a6ff301cd14c1f8f24f88549e6d548f24f64e2148eb0f72cebc51f"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
 [[package]]
 name = "memchr"
 version = "2.8.3"
@@ -1354,6 +1657,15 @@ dependencies = [
  "minimal-lexical",
 ]
 
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -1363,6 +1675,16 @@ dependencies = [
  "autocfg",
 ]
 
+[[package]]
+name = "num_cpus"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
 [[package]]
 name = "object"
 version = "0.39.1"
@@ -1384,6 +1706,65 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7e036b411754132fd6b74e94b74e9a13c5cf606fa93d1885c35860d3060820b1"
 
+[[package]]
+name = "opentelemetry"
+version = "0.33.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c1f1a6ac9c875a4941e4c7c085b61e8f4daa326de03b4701768c3491a6ad9ee"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "js-sys",
+ "pin-project-lite",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "opentelemetry-otlp"
+version = "0.33.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0756af24841e367128ef31c831999937b8b5c5197d47914590d8f4e2e88c2e1a"
+dependencies = [
+ "http",
+ "opentelemetry",
+ "opentelemetry-proto",
+ "opentelemetry_sdk",
+ "prost",
+ "thiserror 2.0.21",
+ "tokio",
+ "tonic",
+ "tonic-types",
+]
+
+[[package]]
+name = "opentelemetry-proto"
+version = "0.33.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d576f5dddc3299341bcd85a04be17b2564844c0c9563214f02d85f2524d1afae"
+dependencies = [
+ "opentelemetry",
+ "opentelemetry_sdk",
+ "prost",
+ "tonic",
+ "tonic-prost",
+]
+
+[[package]]
+name = "opentelemetry_sdk"
+version = "0.33.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "372a912db2974d1990207006fd0e3aa0ef3fd4ad3be43c65cfaadf2206866061"
+dependencies = [
+ "futures-channel",
+ "futures-executor",
+ "futures-util",
+ "opentelemetry",
+ "percent-encoding",
+ "portable-atomic",
+ "rand 0.9.5",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "ordered-float"
 version = "2.10.1"
@@ -1554,14 +1935,78 @@ dependencies = [
 ]
 
 [[package]]
-name = "proc-macro2"
-version = "1.0.107"
+name = "ppv-lite86"
+version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "prometheus-client"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d150ad7bf80e60f45769d18a0a8c01028ab8f56355f33ed7bfce3a31f82e696"
+dependencies = [
+ "dtoa",
+ "itoa",
+ "parking_lot",
+ "prometheus-client-derive-encode",
+]
+
+[[package]]
+name = "prometheus-client-derive-encode"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01e34894696ff94f64a20c2c373a6440903e9c2789a303d68ec6e6f953f890e4"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "prost"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
+dependencies = [
+ "anyhow",
+ "itertools",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f94967dc7688f3054c7fac87473ffae4cc4c3904800e2d9f5b857246d8963b0a"
+dependencies = [
+ "prost",
+]
+
 [[package]]
 name = "psm"
 version = "0.1.32"
@@ -1572,6 +2017,63 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "quinn"
+version = "0.11.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4051e23e9185c255a7e33ef59cdbca87a22d359052eecd22fc6b901fb37d9d11"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.21",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
+dependencies = [
+ "aws-lc-rs",
+ "bytes",
+ "getrandom 0.4.3",
+ "lru-slab",
+ "rand 0.10.3",
+ "rand_pcg",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.21",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af66907df18639dcf4db56ca65490cabc4b27a97dbadd96f2926cca73298f016"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.47"
@@ -1593,6 +2095,61 @@ version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
+[[package]]
+name = "rand"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+dependencies = [
+ "rand_chacha",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -1651,6 +2208,46 @@ version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
+[[package]]
+name = "reqwest"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16a1cfa75cc186dd73d5818e510e042e40927bccc9c236b061cea97e1eb08029"
+dependencies = [
+ "base64 0.23.1",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "serde",
+ "serde_json",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tower",
+ "tower-http 0.6.11",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -1665,6 +2262,12 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
@@ -1707,6 +2310,7 @@ version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
 dependencies = [
+ "web-time",
  "zeroize",
 ]
 
@@ -1923,6 +2527,15 @@ dependencies = [
  "zmij",
 ]
 
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
 [[package]]
 name = "shlex"
 version = "2.0.1"
@@ -2035,6 +2648,9 @@ name = "sync_wrapper"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
 
 [[package]]
 name = "synstructure"
@@ -2087,6 +2703,15 @@ dependencies = [
  "syn 3.0.9",
 ]
 
+[[package]]
+name = "thread_local"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "tinystr"
 version = "0.8.5"
@@ -2097,20 +2722,39 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "tinyvec"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
+
 [[package]]
 name = "tokio"
 version = "1.54.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
 dependencies = [
+ "bytes",
  "libc",
  "mio",
  "pin-project-lite",
  "signal-hook-registry",
  "socket2",
+ "tokio-macros",
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "tokio-macros"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
 [[package]]
 name = "tokio-rustls"
 version = "0.26.6"
@@ -2121,6 +2765,28 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tokio-stream"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-test"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12bc5db7778a8e08ee255090861e0e7aac55e784300077e7ed293c7be36168b2"
+dependencies = [
+ "futures-core",
+ "tokio",
+ "tokio-stream",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.20"
@@ -2136,6 +2802,57 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tonic"
+version = "0.14.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2cdfc673aabd30fe8fee92e65837b644c37c5d47f0f97ae6d5e0f1237d15e1b"
+dependencies = [
+ "async-trait",
+ "base64 0.22.1",
+ "bytes",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-stream",
+ "tokio-util",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tonic-prost"
+version = "0.14.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eba464054e2226f182a34489b8b079bf4c6e3e7ab5fd7fc30e024f24aa92a484"
+dependencies = [
+ "bytes",
+ "prost",
+ "tonic",
+]
+
+[[package]]
+name = "tonic-types"
+version = "0.14.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccbb6c31deb8e99dcdf87df19c5289b7838a600da74a8224baa671e52fe7c5ad"
+dependencies = [
+ "prost",
+ "prost-types",
+ "tonic",
+]
+
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -2144,7 +2861,9 @@ checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
  "futures-core",
  "futures-util",
+ "indexmap",
  "pin-project-lite",
+ "slab",
  "sync_wrapper",
  "tokio",
  "tokio-util",
@@ -2153,6 +2872,24 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags 2.13.2",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
 [[package]]
 name = "tower-http"
 version = "0.7.1"
@@ -2185,6 +2922,20 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
+[[package]]
+name = "tower-test"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4546773ffeab9e4ea02b8872faa49bb616a80a7da66afc2f32688943f97efa7"
+dependencies = [
+ "futures-util",
+ "pin-project",
+ "tokio",
+ "tokio-test",
+ "tower-layer",
+ "tower-service",
+]
+
 [[package]]
 name = "tracing"
 version = "0.1.44"
@@ -2215,6 +2966,63 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
  "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-opentelemetry"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a904802a1b902f43638b677ff2a650847e3b4404101b6c586d648e8c1e3e8fe"
+dependencies = [
+ "js-sys",
+ "opentelemetry",
+ "tracing",
+ "tracing-core",
+ "tracing-subscriber",
+ "web-time",
+]
+
+[[package]]
+name = "tracing-serde"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "704b1aeb7be0d0a84fc9828cae51dab5970fee5088f83d1dd7ee6f6246fc6ff1"
+dependencies = [
+ "serde",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "serde",
+ "serde_json",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+ "tracing-serde",
 ]
 
 [[package]]
@@ -2290,6 +3098,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
@@ -2342,6 +3156,17 @@ dependencies = [
  "wasm-bindgen-shared",
 ]
 
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.80"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e14e0327cb5368ad60ccb22d04a9827a693c95a926d8d125e9fa39e0baec501"
+dependencies = [
+ "js-sys",
+ "tokio",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "wasm-bindgen-macro"
 version = "0.2.130"
@@ -2374,6 +3199,26 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "web-sys"
+version = "0.3.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7d179596ff5ec0f6de4db64d54011bde6289cc49603d3a6e4ce3f329207ab88"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "webpki-root-certs"
 version = "1.0.11"
@@ -2533,6 +3378,29 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
+[[package]]
+name = "wiremock"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08db1edfb05d9b3c1542e521aea074442088292f00b5f28e435c714a98f85031"
+dependencies = [
+ "assert-json-diff",
+ "base64 0.22.1",
+ "deadpool",
+ "futures",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "log",
+ "once_cell",
+ "regex",
+ "serde",
+ "serde_json",
+ "tokio",
+ "url",
+]
+
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
diff --git a/operator/Cargo.toml b/operator/Cargo.toml
index 5f7b8e6b..b0bfaa97 100644
--- a/operator/Cargo.toml
+++ b/operator/Cargo.toml
@@ -15,6 +15,8 @@ schemars = "1"
 serde = { version = "1", features = ["derive"] }
 serde-saphyr = "2"
 serde_json = "1"
+thiserror = "2"
+tracing = "0.1"
 
 [workspace.lints.clippy]
 pedantic = { level = "warn", priority = -1 }
diff --git a/operator/Dockerfile b/operator/Dockerfile
new file mode 100644
index 00000000..b479835d
--- /dev/null
+++ b/operator/Dockerfile
@@ -0,0 +1,18 @@
+# Built from the repository root (docker build -f operator/Dockerfile .):
+# kates-crds reads schemas/ with include_str!.
+FROM rust:1.99.1-bookworm@sha256:7085845219c18e7c5b1f34ed9ce89b84f822f2e3d54a02774cedc996ac0f304f AS builder
+RUN apt-get update && apt-get install -y --no-install-recommends musl-tools && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+COPY schemas/ schemas/
+COPY operator/ operator/
+
+WORKDIR /build/operator
+RUN target="$(uname -m)-unknown-linux-musl" \
+    && rustup target add "$target" \
+    && cargo build --release --locked --target "$target" -p kates-operator --features telemetry \
+    && cp "target/$target/release/kates-operator" /kates-operator
+
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
+COPY --from=builder /kates-operator /kates-operator
+ENTRYPOINT ["/kates-operator"]
diff --git a/operator/chart/.helmignore b/operator/chart/.helmignore
new file mode 100644
index 00000000..d69cba37
--- /dev/null
+++ b/operator/chart/.helmignore
@@ -0,0 +1,2 @@
+.git
+*.md.orig
diff --git a/operator/chart/Chart.yaml b/operator/chart/Chart.yaml
new file mode 100644
index 00000000..6a31d86d
--- /dev/null
+++ b/operator/chart/Chart.yaml
@@ -0,0 +1,17 @@
+apiVersion: v2
+name: kates-operator
+description: Kates runs and compliance checks as Kubernetes resources, driving an existing Kates API
+type: application
+version: 0.1.1
+appVersion: "0.1.1"
+kubeVersion: ">=1.29.0-0"
+home: https://github.com/bmscomp/kates
+sources:
+  - https://github.com/bmscomp/kates
+maintainers:
+  - name: bmscomp
+    url: https://github.com/bmscomp
+keywords:
+  - kafka
+  - kates
+  - operator
diff --git a/operator/chart/README.md b/operator/chart/README.md
new file mode 100644
index 00000000..dc11b626
--- /dev/null
+++ b/operator/chart/README.md
@@ -0,0 +1,216 @@
+# kates-operator
+
+Kates runs and compliance checks as Kubernetes resources. `KatesTest` is one run and `KafkaCompliance` a standing check. A team can commit `loadtest.yaml`, watch it with `kubectl get katestests`, and gate a pipeline on it.
+
+The operator drives a Kates API that is already running, through its REST API. It doesn't install Kates, and it needs Kates 1.38.0 or newer: older versions can't honour an idempotency key, so every `KatesTest` waits at `Synced=False`, reason `ApiTooOld`, and starts no run.
+
+## Install
+
+```bash
+helm install kates-operator oci://ghcr.io/bmscomp/charts/kates-operator --version 0.1.1 \
+  -n kates-operator --create-namespace
+```
+
+It needs Kubernetes 1.29 or newer and pulls `ghcr.io/bmscomp/kates-operator`, for amd64 and arm64. On a cluster that pulls from a mirror, set `global.imageRegistry` and `global.imagePullSecrets`. The image and the chart are signed with cosign:
+
+```bash
+cosign verify ghcr.io/bmscomp/kates-operator:0.1.1 \
+  --certificate-identity-regexp 'https://github.com/bmscomp/kates/.github/workflows/publish-operator.yml@refs/tags/operator-v.*' \
+  --certificate-oidc-issuer https://token.actions.githubusercontent.com
+```
+
+To run your own build, from the repository root:
+
+```bash
+docker build -f operator/Dockerfile -t <registry>/kates-operator:dev .
+docker push <registry>/kates-operator:dev
+helm install kates-operator operator/chart -n kates-operator --create-namespace \
+  --set image.repository=<registry>/kates-operator --set image.tag=dev
+```
+
+| Mode | Values | Rendered |
+| --- | --- | --- |
+| Its own namespace | (default) | A ClusterRole, a RoleBinding in the release namespace |
+| Some namespaces | `watchNamespaces: [a, b]` | The same ClusterRole, a RoleBinding in each |
+| Every namespace | `watchAnyNamespace: true` | The same ClusterRole, a ClusterRoleBinding |
+| No cluster-scoped rights | `rbac.clusterRoles.create: false` | A Role in the release namespace, and nothing cluster-scoped |
+
+For the last mode a cluster admin applies the CRDs and the aggregated roles once, and the namespace admin installs with `--skip-crds`:
+
+```bash
+helm pull oci://ghcr.io/bmscomp/charts/kates-operator --version 0.1.1 --untar
+kubectl apply --server-side -f kates-operator/crds/
+helm template kates-operator ./kates-operator -n team --show-only templates/aggregate-roles.yaml | kubectl apply -f -
+helm install kates-operator ./kates-operator -n team --skip-crds \
+  --set rbac.clusterRoles.create=false --set rbac.aggregateRoles.create=false
+```
+
+CRDs are applied by a pre-install and pre-upgrade hook that never downgrades: with several releases on a cluster, the newest wins. On a cluster that already has the CRDs, pass `--skip-crds`. A conflict on `customresourcedefinitions.apiextensions.k8s.io` during install means the flag was missed, and `--force-conflicts` is a downgrade, not the fix.
+
+Don't let two releases watch the same namespace: each would reconcile the same resources.
+
+## Connect a namespace
+
+Each watched namespace holds a Secret named `kates-connection`, with the keys `url`, `apiKey` and optional `caBundle`:
+
+```bash
+kubectl create secret generic kates-connection -n payments \
+  --from-literal=url=http://kates.kates.svc:8080 --from-literal=apiKey=<key>
+```
+
+The key needs `read` and `test:run`. Use a named key from the Kates keys file, so the audit log names the team. `connection.fallback: true` lends the Secret `connection.existingSecret` to every watched namespace that has no `kates-connection`. With `watchAnyNamespace`, that lends the key to everyone who can create a `KatesTest`.
+
+To rotate a key, add the new hash to the Kates keys file, swap the Secret, then remove the old hash. The operator reads the key on every pass, so it needs no restart.
+
+## KatesTest
+
+```yaml
+apiVersion: kates.io/v1alpha1
+kind: KatesTest
+metadata:
+  name: nightly-load
+spec:
+  type: LOAD
+  spec:
+    numRecords: 100000
+    acks: all
+  sla:
+    maxP99LatencyMs: 100
+```
+
+`spec.spec` takes the wire names of `POST /api/tests`, and the CRD refuses a mistyped key. `spec.sla` is graded by the Kates API, the same way the report and the JUnit export grade it. Once the run has started, the whole `spec` is immutable, because the resource is the evidence of what the run was judged against.
+
+A CI gate is two commands, race-free on either outcome:
+
+```bash
+kubectl wait --for=jsonpath='{.status.finishedAt}' katestest/nightly-load --timeout=30m
+kubectl wait --for=condition=Ready katestest/nightly-load --timeout=0
+```
+
+The first returns on every ending, and the second exits non-zero on a failed run. `kubectl describe` shows the failing key. The value-less `jsonpath` form needs kubectl 1.29 or newer.
+
+Deleting a `KatesTest` whose run is live cancels the run first. The run's record stays in Kates. A deleted and re-created `KatesTest` is a new run.
+
+### On a schedule
+
+There is no schedule kind. A `CronJob` creates one `KatesTest` per firing, and waits for it so `Forbid` holds across firings:
+
+```yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: nightly-load
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: nightly-load
+rules:
+  - apiGroups: [kates.io]
+    resources: [katestests]
+    verbs: [create, get, list, watch]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: nightly-load
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: nightly-load
+subjects:
+  - kind: ServiceAccount
+    name: nightly-load
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: nightly-load
+spec:
+  schedule: "0 2 * * *"
+  timeZone: Etc/UTC
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 600
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      template:
+        spec:
+          serviceAccountName: nightly-load
+          restartPolicy: Never
+          containers:
+            - name: run
+              image: ghcr.io/bmscomp/kates-tester:1.38.0
+              command: [/bin/sh, -ec]
+              args:
+                - |
+                  run=$(kubectl create -o name -f - <<EOF
+                  apiVersion: kates.io/v1alpha1
+                  kind: KatesTest
+                  metadata:
+                    generateName: nightly-load-
+                  spec:
+                    type: LOAD
+                    spec: {numRecords: 1000000}
+                    sla: {maxP99LatencyMs: 100}
+                    ttlSecondsAfterFinished: 86400
+                  EOF
+                  )
+                  kubectl wait --for=jsonpath='{.status.finishedAt}' "$run" --timeout=30m
+                  kubectl wait --for=condition=Ready "$run" --timeout=0
+```
+
+The Job fails when the run does, so the `CronJob`'s history shows the missed gates. The API's own `/api/schedules` is still there, but it needs an `admin` key and leaves no resource per firing.
+
+`kates-tester` is unsigned. Where the Kates chart's `kyvernoPolicy.cosign` is on with Enforce, its pod is refused in that release's namespace: run the `CronJob` in another namespace and bind its ServiceAccount in the target, or use your own image with a shell and kubectl.
+
+### GitOps
+
+To rerun a `KatesTest`, rename it: the new name is a new run. With pruning on, the old resource is deleted, and its run is cancelled first if it is still live.
+
+- A spec edit under the same name, after the run started, is refused at dry-run. Flux dry-runs every object first, so that one refusal fails the whole Kustomization. Keep `KatesTest`s in their own Kustomization or Application.
+- Don't use Flux `spec.force: true`, or Argo CD `Replace=true,Force=true`. A refused edit then deletes and re-creates the resource, which starts a new run with no review.
+- Never set `ttlSecondsAfterFinished` on a resource a GitOps tool holds: the tool re-creates it, and the run repeats every TTL. The TTL is for one-shot resources a pipeline creates under a unique name.
+
+## KafkaCompliance
+
+```yaml
+apiVersion: kates.io/v1alpha1
+kind: KafkaCompliance
+metadata:
+  name: krafter-rules
+spec:
+  interval: 1h
+  reference:
+    target: {namespace: kafka, name: krafter}
+    brokers:
+      count: {min: 3}
+      zones: {min: 3}
+```
+
+`spec.reference` is a `KafkaReference` `.spec`, inline, and the API's strict reader checks it. The resource's name becomes the stored check's name, so it must be a DNS label. Intervals under a minute are raised to one minute, and intervals over a year lowered to one year.
+
+A check also runs when the spec changes, and when the Strimzi `Kafka` it names has finished reconciling a change, if that namespace is in `kafka.namespaces`. Any other target is checked on its interval alone, and `KafkaWatched=False` says why. `spec.suspend: true` stops new checks.
+
+## Operating it
+
+| Annotation | Effect |
+| --- | --- |
+| `kates.io/pause-reconciliation: "true"` | No calls to the Kates API. A deleted resource is never paused |
+| `kates.io/reconcile-at: <new value>` | Forces a pass, recorded in `status.lastHandledReconcileAt` |
+
+Before `helm uninstall`, before dropping a namespace from `watchNamespaces`, and before deleting a namespace, delete its live `KatesTest`s. A finished `KatesTest` holds no finalizer and blocks nothing.
+
+A live one left behind needs a hand. With `watchNamespaces` or the default mode, the RoleBinding that gives the operator its rights lives in the namespace, so `kubectl delete namespace` removes those rights along with everything else. The operator can then no longer clear its finalizer, and the namespace stays Terminating until you do:
+
+```bash
+kubectl patch katestest <name> -n <namespace> --type=merge -p '{"metadata":{"finalizers":null}}'
+```
+
+Kates ends the run at its own timeout. With `watchAnyNamespace` the ClusterRoleBinding survives: if the Secret goes first, the finalizer comes off with a `CancelSkipped` Event.
+
+The NetworkPolicy allows egress on 8080, 443 and 6443. A Kates URL on any other port needs `networkPolicy.egressRules`, or the blocked call shows as `ApiUnavailable`.
+
+Metrics are on `:8080/metrics` under `kates_operator_`, and `monitoring.enabled` renders a PodMonitor. `/readyz` fails on an unreachable API server or a stale served CRD, and it reports the Lease and any refused Kafka namespace in its body without failing on them.
+
+One pod holds the Lease `kates-operator` in the release namespace. `replicas: 2` only shortens the gap after a crash, to between 5 and 15 seconds.
diff --git a/operator/chart/crds/kafkacompliances.kates.io.yaml b/operator/chart/crds/kafkacompliances.kates.io.yaml
new file mode 100644
index 00000000..73d945d0
--- /dev/null
+++ b/operator/chart/crds/kafkacompliances.kates.io.yaml
@@ -0,0 +1,192 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: kafkacompliances.kates.io
+spec:
+  group: kates.io
+  names:
+    kind: KafkaCompliance
+    plural: kafkacompliances
+    singular: kafkacompliance
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.verdict
+      name: Verdict
+      type: string
+    - jsonPath: .status.checkedAt
+      name: Checked
+      type: date
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: "A standing compliance check of one Kafka. crd-version: 1"
+        properties:
+          spec:
+            description: A standing compliance check of one Kafka.
+            properties:
+              interval:
+                description: How often to check, such as 30m or 1h.
+                pattern: ^([0-9]+(s|m|h))+$
+                type: string
+              reference:
+                description: A `KafkaReference` `.spec`, inline; its target names the Kafka.
+                properties:
+                  target:
+                    properties:
+                      name:
+                        type: string
+                      namespace:
+                        type: string
+                    required:
+                    - name
+                    - namespace
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                required:
+                - target
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              suspend:
+                default: false
+                description: Stops new checks without touching what the last one found.
+                type: boolean
+            required:
+            - interval
+            - reference
+            type: object
+          status:
+            nullable: true
+            properties:
+              checkId:
+                description: "`/api/conformity/checks/{id}`; absent when the API kept no report."
+                nullable: true
+                type: string
+              checkedAt:
+                description: >-
+                  Time is a wrapper around time.Time which supports correct marshaling to YAML
+                  and JSON.  Wrappers are provided for many of the factory methods that the time
+                  package offers.
+                format: date-time
+                nullable: true
+                type: string
+              conditions:
+                items:
+                  description: >-
+                    Condition contains details for one aspect of the current state of this API
+                    Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: >-
+                        lastTransitionTime is the last time the condition transitioned from one status
+                        to another. This should be when the underlying condition changed.  If that is not
+                        known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: >-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      type: string
+                    observedGeneration:
+                      description: >-
+                        observedGeneration represents the .metadata.generation that the condition was
+                        set based upon. For instance, if .metadata.generation is currently 12, but the
+                        .status.conditions[x].observedGeneration is 9, the condition is out of date with
+                        respect to the current state of the instance.
+                      format: int64
+                      type: integer
+                    reason:
+                      description: >-
+                        reason contains a programmatic identifier indicating the reason for the
+                        condition's last transition. Producers of specific condition types may define expected
+                        values and meanings for this field, and whether the values are considered a
+                        guaranteed API. The value should be a CamelCase string. This field may not be empty.
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              counts:
+                nullable: true
+                properties:
+                  fail:
+                    format: int64
+                    type: integer
+                  pass:
+                    format: int64
+                    type: integer
+                  unknown:
+                    format: int64
+                    type: integer
+                required:
+                - fail
+                - pass
+                - unknown
+                type: object
+              failed:
+                description: At most 20; the report has the rest.
+                items:
+                  properties:
+                    detail:
+                      nullable: true
+                      type: string
+                    rule:
+                      type: string
+                  required:
+                  - rule
+                  type: object
+                type: array
+              lastHandledReconcileAt:
+                description: The `kates.io/reconcile-at` value last acted on.
+                nullable: true
+                type: string
+              nextCheckAt:
+                description: >-
+                  Time is a wrapper around time.Time which supports correct marshaling to YAML
+                  and JSON.  Wrappers are provided for many of the factory methods that the time
+                  package offers.
+                format: date-time
+                nullable: true
+                type: string
+              observedGeneration:
+                format: int64
+                nullable: true
+                type: integer
+              observedKafkaGeneration:
+                description: The Kafka's `status.observedGeneration` at the last answered check.
+                format: int64
+                nullable: true
+                type: integer
+              verdict:
+                description: PASS, FAIL or UNKNOWN.
+                nullable: true
+                type: string
+            type: object
+        required:
+        - spec
+        title: KafkaCompliance
+        type: object
+        x-kubernetes-validations:
+        - message: "name must be a DNS label (at most 63 lower-case letters, digits and -): it names the stored compliance check"
+          rule: self.metadata.name.matches('^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$')
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/operator/crds/katestests.kates.io.yaml b/operator/chart/crds/katestests.kates.io.yaml
similarity index 100%
rename from operator/crds/katestests.kates.io.yaml
rename to operator/chart/crds/katestests.kates.io.yaml
diff --git a/operator/chart/templates/NOTES.txt b/operator/chart/templates/NOTES.txt
new file mode 100644
index 00000000..7b440fd9
--- /dev/null
+++ b/operator/chart/templates/NOTES.txt
@@ -0,0 +1,10 @@
+kates-operator reconciles KatesTest and KafkaCompliance in: {{ include "kates-operator.namespaces" . }}
+
+Each of those namespaces needs a Secret named kates-connection (keys url, apiKey, optional caBundle):
+
+  kubectl create secret generic kates-connection -n <namespace> \
+    --from-literal=url=http://kates.kates.svc:8080 --from-literal=apiKey=<a key with read, test:run>
+
+Then:
+
+  kubectl get katestests,kafkacompliances -A
diff --git a/operator/chart/templates/_helpers.tpl b/operator/chart/templates/_helpers.tpl
new file mode 100644
index 00000000..eaa942e2
--- /dev/null
+++ b/operator/chart/templates/_helpers.tpl
@@ -0,0 +1,71 @@
+{{- define "kates-operator.fullname" -}}
+{{- printf "kates-operator-%s" .Release.Namespace | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "kates-operator.selectorLabels" -}}
+app.kubernetes.io/name: kates-operator
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "kates-operator.labels" -}}
+{{ include "kates-operator.selectorLabels" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }}
+{{- end -}}
+
+{{- define "kates-operator.image" -}}
+{{- $image := printf "%s:%s" .Values.image.repository (.Values.image.tag | default .Chart.AppVersion) -}}
+{{- with .Values.image.digest -}}{{- $image = printf "%s@%s" $.Values.image.repository . -}}{{- end -}}
+{{- with .Values.global.imageRegistry -}}{{ printf "%s/%s" (trimSuffix "/" .) $image }}{{- else -}}{{ $image }}{{- end -}}
+{{- end -}}
+
+{{- define "kates-operator.imagePullSecrets" -}}
+{{- $secrets := concat (.Values.global.imagePullSecrets | default list) (.Values.imagePullSecrets | default list) -}}
+{{- with $secrets }}
+imagePullSecrets:
+  {{- range . }}
+  - name: {{ if kindIs "string" . }}{{ . }}{{ else }}{{ .name }}{{ end }}
+  {{- end }}
+{{- end }}
+{{- end -}}
+
+{{/* The namespaces this release reconciles, or * for all of them. */}}
+{{- define "kates-operator.namespaces" -}}
+{{- if .Values.watchAnyNamespace -}}*
+{{- else if .Values.watchNamespaces -}}{{ join "," .Values.watchNamespaces }}
+{{- else -}}{{ .Release.Namespace }}
+{{- end -}}
+{{- end -}}
+
+{{/* What the operator may do where it reconciles. */}}
+{{- define "kates-operator.rules" -}}
+- apiGroups: ["kates.io"]
+  resources: ["katestests", "kafkacompliances"]
+  verbs: ["get", "list", "watch", "patch", "update", "delete"]
+- apiGroups: ["kates.io"]
+  resources: ["katestests/status", "kafkacompliances/status", "katestests/finalizers", "kafkacompliances/finalizers"]
+  verbs: ["get", "patch", "update"]
+- apiGroups: ["events.k8s.io"]
+  resources: ["events"]
+  verbs: ["create", "patch"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get"]
+  resourceNames: ["kates-connection"]
+{{- end -}}
+
+{{- define "kates-operator.podSecurityContext" -}}
+runAsNonRoot: true
+runAsUser: 65532
+runAsGroup: 65532
+seccompProfile:
+  type: RuntimeDefault
+{{- end -}}
+
+{{- define "kates-operator.securityContext" -}}
+allowPrivilegeEscalation: false
+readOnlyRootFilesystem: true
+capabilities:
+  drop:
+    - ALL
+{{- end -}}
diff --git a/operator/chart/templates/aggregate-roles.yaml b/operator/chart/templates/aggregate-roles.yaml
new file mode 100644
index 00000000..e736d4e7
--- /dev/null
+++ b/operator/chart/templates/aggregate-roles.yaml
@@ -0,0 +1,35 @@
+{{- if .Values.rbac.aggregateRoles.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kates-operator-view-{{ .Release.Namespace }}
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+rules:
+  - apiGroups: ["kates.io"]
+    resources: ["katestests", "kafkacompliances"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kates-operator-edit-{{ .Release.Namespace }}
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+rules:
+  - apiGroups: ["kates.io"]
+    resources: ["katestests", "kafkacompliances"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kates-operator-admin-{{ .Release.Namespace }}
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+rules:
+  {{- include "kates-operator.rules" . | nindent 2 }}
+{{- end }}
diff --git a/operator/chart/templates/crd-upgrade.yaml b/operator/chart/templates/crd-upgrade.yaml
new file mode 100644
index 00000000..2858da86
--- /dev/null
+++ b/operator/chart/templates/crd-upgrade.yaml
@@ -0,0 +1,83 @@
+{{- if and .Values.crdUpgrade.enabled .Values.rbac.clusterRoles.create }}
+{{- $name := printf "kates-operator-crd-upgrade-%s" .Release.Namespace | trunc 63 | trimSuffix "-" }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kates-operator-crd-upgrade
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-weight: "1"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ $name }}
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-weight: "1"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+rules:
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    resourceNames: ["katestests.kates.io", "kafkacompliances.kates.io"]
+    verbs: ["get", "create", "patch"]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ $name }}
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-weight: "1"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ $name }}
+subjects:
+  - kind: ServiceAccount
+    name: kates-operator-crd-upgrade
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: kates-operator-crd-upgrade
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-weight: "5"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      labels:
+        {{- toYaml (merge (dict "app.kubernetes.io/component" "crd-upgrade" "app.kubernetes.io/managed-by" .Release.Service) .Values.podLabels) | nindent 8 }}
+    spec:
+      restartPolicy: Never
+      serviceAccountName: kates-operator-crd-upgrade
+      {{- include "kates-operator.imagePullSecrets" . | nindent 6 }}
+      securityContext:
+        {{- include "kates-operator.podSecurityContext" . | nindent 8 }}
+      containers:
+        - name: crd-upgrade
+          image: {{ include "kates-operator.image" . | quote }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args: ["crds", "apply"]
+          securityContext:
+            {{- include "kates-operator.securityContext" . | nindent 12 }}
+          resources:
+            {{- toYaml .Values.crdUpgrade.resources | nindent 12 }}
+{{- end }}
diff --git a/operator/chart/templates/deployment.yaml b/operator/chart/templates/deployment.yaml
new file mode 100644
index 00000000..98c67921
--- /dev/null
+++ b/operator/chart/templates/deployment.yaml
@@ -0,0 +1,97 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kates-operator
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicas }}
+  # A rolling update would run two reconcilers until the old pod lets go of the Lease.
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "kates-operator.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- toYaml (merge (include "kates-operator.labels" . | fromYaml) .Values.podLabels) | nindent 8 }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      serviceAccountName: kates-operator
+      {{- include "kates-operator.imagePullSecrets" . | nindent 6 }}
+      securityContext:
+        {{- include "kates-operator.podSecurityContext" . | nindent 8 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: operator
+          image: {{ include "kates-operator.image" . | quote }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- include "kates-operator.securityContext" . | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: KATES_OPERATOR_NAMESPACES
+              value: {{ include "kates-operator.namespaces" . | quote }}
+            - name: KATES_OPERATOR_KAFKA_NAMESPACES
+              value: {{ if .Values.watchAnyNamespace }}"*"{{ else }}{{ join "," .Values.kafka.namespaces | quote }}{{ end }}
+            - name: LOG_FORMAT
+              value: {{ .Values.logFormat | quote }}
+            {{- with .Values.tracing.endpoint }}
+            - name: OTEL_EXPORTER_OTLP_ENDPOINT
+              value: {{ . | quote }}
+            {{- end }}
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: http
+            periodSeconds: 10
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          {{- if .Values.connection.fallback }}
+          volumeMounts:
+            - name: connection
+              mountPath: /etc/kates-operator/connection
+              readOnly: true
+          {{- end }}
+      {{- if .Values.connection.fallback }}
+      # Projected with no subPath, so the kubelet refreshes a rotated key; optional, so a
+      # missing Secret leaves the resources at NoConnection and the pod running.
+      volumes:
+        - name: connection
+          projected:
+            sources:
+              - secret:
+                  name: {{ .Values.connection.existingSecret }}
+                  optional: true
+      {{- end }}
diff --git a/operator/chart/templates/kafka-reader.yaml b/operator/chart/templates/kafka-reader.yaml
new file mode 100644
index 00000000..de5cc3f9
--- /dev/null
+++ b/operator/chart/templates/kafka-reader.yaml
@@ -0,0 +1,34 @@
+{{- if and .Values.rbac.kafkaNamespaceRole (not .Values.watchAnyNamespace) }}
+{{- $root := . }}
+{{- $name := printf "kates-operator-kafka-reader-%s" .Release.Namespace | trunc 63 | trimSuffix "-" }}
+{{- range .Values.kafka.namespaces }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ $name }}
+  namespace: {{ . }}
+  labels:
+    {{- include "kates-operator.labels" $root | nindent 4 }}
+rules:
+  - apiGroups: ["kafka.strimzi.io"]
+    resources: ["kafkas"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ $name }}
+  namespace: {{ . }}
+  labels:
+    {{- include "kates-operator.labels" $root | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ $name }}
+subjects:
+  - kind: ServiceAccount
+    name: kates-operator
+    namespace: {{ $root.Release.Namespace }}
+{{- end }}
+{{- end }}
diff --git a/operator/chart/templates/networkpolicy.yaml b/operator/chart/templates/networkpolicy.yaml
new file mode 100644
index 00000000..677d7c5b
--- /dev/null
+++ b/operator/chart/templates/networkpolicy.yaml
@@ -0,0 +1,43 @@
+{{- if .Values.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: kates-operator
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "kates-operator.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ .Values.networkPolicy.monitoringNamespace }}
+      ports:
+        - port: http
+          protocol: TCP
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    # Ports only, with no to: the template cannot know which namespace a kates-connection names.
+    - ports:
+        - port: 8080
+          protocol: TCP
+    # 6443 is the API server's own port after the kubernetes Service's DNAT, and NetworkPolicy
+    # leaves undefined whether a policy runs before or after that rewrite.
+    - ports:
+        - port: 443
+          protocol: TCP
+        - port: 6443
+          protocol: TCP
+    {{- with .Values.networkPolicy.egressRules }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+{{- end }}
diff --git a/operator/chart/templates/podmonitor.yaml b/operator/chart/templates/podmonitor.yaml
new file mode 100644
index 00000000..48d69101
--- /dev/null
+++ b/operator/chart/templates/podmonitor.yaml
@@ -0,0 +1,15 @@
+{{- if .Values.monitoring.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: kates-operator
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "kates-operator.selectorLabels" . | nindent 6 }}
+  podMetricsEndpoints:
+    - port: http
+      path: /metrics
+{{- end }}
diff --git a/operator/chart/templates/rbac.yaml b/operator/chart/templates/rbac.yaml
new file mode 100644
index 00000000..b50386af
--- /dev/null
+++ b/operator/chart/templates/rbac.yaml
@@ -0,0 +1,110 @@
+{{- $name := include "kates-operator.fullname" . -}}
+{{- $clusterScoped := .Values.rbac.clusterRoles.create -}}
+{{- if not $clusterScoped }}
+{{- if or .Values.watchNamespaces .Values.watchAnyNamespace }}
+{{- fail "rbac.clusterRoles.create=false installs in the release namespace alone: leave watchNamespaces and watchAnyNamespace unset" }}
+{{- end }}
+{{- if .Values.kafka.namespaces }}
+{{- fail "rbac.clusterRoles.create=false takes no kafka.namespaces: a Kafka namespace's Role is that namespace's admin's to apply, and compliance then runs on its interval" }}
+{{- end }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: kates-operator
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+rules:
+  {{- include "kates-operator.rules" . | nindent 2 }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kates-operator
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kates-operator
+subjects:
+  - kind: ServiceAccount
+    name: kates-operator
+    namespace: {{ .Release.Namespace }}
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kates-operator-namespaced-{{ .Release.Namespace }}
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+rules:
+  {{- include "kates-operator.rules" . | nindent 2 }}
+  {{- if .Values.watchAnyNamespace }}
+  - apiGroups: ["kafka.strimzi.io"]
+    resources: ["kafkas"]
+    verbs: ["get", "list", "watch"]
+  {{- end }}
+{{- if .Values.watchAnyNamespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ $name }}
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kates-operator-namespaced-{{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: kates-operator
+    namespace: {{ .Release.Namespace }}
+{{- else }}
+{{- $root := . }}
+{{- range ternary .Values.watchNamespaces (list .Release.Namespace) (gt (len .Values.watchNamespaces) 0) }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ $name }}
+  namespace: {{ . }}
+  labels:
+    {{- include "kates-operator.labels" $root | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kates-operator-namespaced-{{ $root.Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: kates-operator
+    namespace: {{ $root.Release.Namespace }}
+{{- end }}
+{{- end }}
+{{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: kates-operator-leader-election
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kates-operator-leader-election
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kates-operator-leader-election
+subjects:
+  - kind: ServiceAccount
+    name: kates-operator
+    namespace: {{ .Release.Namespace }}
diff --git a/operator/chart/templates/serviceaccount.yaml b/operator/chart/templates/serviceaccount.yaml
new file mode 100644
index 00000000..d9db1d4a
--- /dev/null
+++ b/operator/chart/templates/serviceaccount.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kates-operator
+  labels:
+    {{- include "kates-operator.labels" . | nindent 4 }}
diff --git a/operator/chart/values.schema.json b/operator/chart/values.schema.json
new file mode 100644
index 00000000..38d75560
--- /dev/null
+++ b/operator/chart/values.schema.json
@@ -0,0 +1,105 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "kates-operator values",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "global": {
+      "type": "object",
+      "properties": {
+        "imageRegistry": { "type": "string" },
+        "imagePullSecrets": { "$ref": "#/$defs/pullSecrets" }
+      }
+    },
+    "image": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "repository": { "type": "string", "minLength": 1 },
+        "tag": { "type": "string", "not": { "const": "latest" } },
+        "digest": { "type": "string", "pattern": "^(sha256:[0-9a-f]{64})?$" },
+        "pullPolicy": { "enum": ["Always", "IfNotPresent", "Never"] }
+      }
+    },
+    "imagePullSecrets": { "$ref": "#/$defs/pullSecrets" },
+    "watchNamespaces": { "$ref": "#/$defs/names" },
+    "watchAnyNamespace": { "type": "boolean" },
+    "kafka": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": { "namespaces": { "$ref": "#/$defs/names" } }
+    },
+    "rbac": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "clusterRoles": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": { "create": { "type": "boolean" } }
+        },
+        "aggregateRoles": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": { "create": { "type": "boolean" } }
+        },
+        "kafkaNamespaceRole": { "type": "boolean" }
+      }
+    },
+    "connection": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "fallback": { "type": "boolean" },
+        "existingSecret": { "type": "string", "minLength": 1 }
+      }
+    },
+    "crdUpgrade": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "resources": { "type": "object" }
+      }
+    },
+    "replicas": { "type": "integer", "minimum": 1 },
+    "resources": { "type": "object" },
+    "logFormat": { "enum": ["text", "json"] },
+    "tracing": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": { "endpoint": { "type": "string" } }
+    },
+    "networkPolicy": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "monitoringNamespace": { "type": "string" },
+        "egressRules": { "type": "array", "items": { "type": "object" } }
+      }
+    },
+    "monitoring": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": { "enabled": { "type": "boolean" } }
+    },
+    "podLabels": { "type": "object", "additionalProperties": { "type": "string" } },
+    "podAnnotations": { "type": "object" },
+    "nodeSelector": { "type": "object" },
+    "tolerations": { "type": "array" },
+    "affinity": { "type": "object" }
+  },
+  "$defs": {
+    "names": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "pullSecrets": {
+      "type": "array",
+      "items": {
+        "anyOf": [
+          { "type": "string", "minLength": 1 },
+          { "type": "object", "required": ["name"], "properties": { "name": { "type": "string", "minLength": 1 } } }
+        ]
+      }
+    }
+  }
+}
diff --git a/operator/chart/values.yaml b/operator/chart/values.yaml
new file mode 100644
index 00000000..d7f3eb2e
--- /dev/null
+++ b/operator/chart/values.yaml
@@ -0,0 +1,99 @@
+# The Kates operator. It drives a Kates API that is already running and never
+# installs one. A resource reads its API and key from the Secret
+# kates-connection in its own namespace (keys url, apiKey, optional caBundle).
+
+global:
+  # -- Registry prepended to the image, with a slash, for clusters that pull
+  # from a mirror.
+  imageRegistry: ""
+  # -- Pull secrets for that registry, as names or {name: …}.
+  imagePullSecrets: []
+
+image:
+  repository: ghcr.io/bmscomp/kates-operator
+  # -- Empty: the chart's appVersion.
+  tag: ""
+  # -- sha256:… pins by content and wins over the tag.
+  digest: ""
+  pullPolicy: IfNotPresent
+
+# -- Pull secrets of this chart's pods.
+imagePullSecrets: []
+
+# -- Namespaces whose resources this release reconciles. Empty: its own.
+watchNamespaces: []
+# -- Reconcile every namespace, with a ClusterRoleBinding.
+watchAnyNamespace: false
+
+kafka:
+  # -- Namespaces whose Strimzi Kafkas trigger a compliance check when they
+  # change. Empty: checks run on their interval only.
+  namespaces: []
+
+rbac:
+  clusterRoles:
+    # -- false renders nothing cluster-scoped, for a namespace admin: apply the
+    # CRDs and aggregate-roles.yaml once as a cluster admin, and install with
+    # --skip-crds. Not with watchNamespaces or watchAnyNamespace.
+    create: true
+  aggregateRoles:
+    # -- Fold the kinds into the built-in view, edit and admin roles.
+    create: true
+  # -- Render the Role that lets the operator read Kafkas in kafka.namespaces.
+  # false: someone with rights there applies it from helm template --show-only.
+  kafkaNamespaceRole: true
+
+connection:
+  # -- Lend every watched namespace the Secret below when it has no
+  # kates-connection of its own. With watchAnyNamespace that lends this key to
+  # every user who can create a KatesTest.
+  fallback: false
+  # -- The fallback Secret (keys url, apiKey, optional caBundle). This chart
+  # never renders it, so no key sits in Helm values.
+  existingSecret: kates-operator-connection
+
+crdUpgrade:
+  # -- Apply the CRDs from a pre-install and pre-upgrade hook, never over a
+  # newer version. Off with rbac.clusterRoles.create=false.
+  enabled: true
+  resources:
+    requests:
+      cpu: 10m
+      memory: 32Mi
+    limits:
+      memory: 64Mi
+
+# -- 2 only shortens the gap after a crash: one pod holds the Lease.
+replicas: 1
+
+resources:
+  requests:
+    cpu: 25m
+    memory: 48Mi
+  limits:
+    memory: 128Mi
+
+# -- text or json.
+logFormat: json
+
+tracing:
+  # -- OTLP endpoint; empty sends no traces.
+  endpoint: ""
+
+networkPolicy:
+  enabled: true
+  # -- Namespace allowed to scrape metrics on 8080.
+  monitoringNamespace: monitoring
+  # -- Extra egress rules, for a Kates URL on a port other than 8080 or 443.
+  egressRules: []
+
+monitoring:
+  # -- Render a PodMonitor. Needs the Prometheus Operator's CRDs.
+  enabled: false
+
+# -- Labels added to the pods; the chart's own win on a clash.
+podLabels: {}
+podAnnotations: {}
+nodeSelector: {}
+tolerations: []
+affinity: {}
diff --git a/operator/crates/kates-client/Cargo.toml b/operator/crates/kates-client/Cargo.toml
new file mode 100644
index 00000000..57c553e1
--- /dev/null
+++ b/operator/crates/kates-client/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+name = "kates-client"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[dependencies]
+reqwest = { version = "0.13", default-features = false, features = ["rustls", "json", "http2", "charset"] }
+secrecy = "0.10"
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+
+[dev-dependencies]
+tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
+wiremock = "0.6"
+
+[lints]
+workspace = true
diff --git a/operator/crates/kates-client/src/lib.rs b/operator/crates/kates-client/src/lib.rs
new file mode 100644
index 00000000..0d41972f
--- /dev/null
+++ b/operator/crates/kates-client/src/lib.rs
@@ -0,0 +1,760 @@
+//! The Kates REST API, as the operator uses it. Every answer is classified into [`Error`], so the
+//! reconcilers decide on variants and never on status codes.
+
+use std::collections::BTreeMap;
+use std::sync::Arc;
+use std::time::Duration;
+
+use reqwest::header::{HeaderMap, LOCATION, RETRY_AFTER};
+use reqwest::{Certificate, Method, Response, StatusCode, redirect};
+use secrecy::{ExposeSecret, SecretString};
+use serde::Deserialize;
+use serde_json::Value;
+
+const CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
+// The CLI's figure, above the 35 s snapshot bound of a first report, so the API's own 503s arrive.
+const REQUEST_TIMEOUT: Duration = Duration::from_mins(1);
+const MAX_BODY: usize = 8 * 1024 * 1024;
+
+/// Told of every call: method, route template (never the URL), status (0 for a network error).
+pub type Observer = Arc<dyn Fn(&'static str, &'static str, u16) + Send + Sync>;
+
+#[derive(Debug, Clone, PartialEq, thiserror::Error)]
+pub enum Error {
+    /// A 4xx with an `ApiError` body: the request is wrong as written.
+    #[error("{message}")]
+    Rejected {
+        status: u16,
+        message: String,
+        field_errors: BTreeMap<String, String>,
+    },
+    #[error("{message}")]
+    Conflict { message: String },
+    /// 429: the engine is full.
+    #[error("{message}")]
+    RateLimited {
+        retry_after: Option<Duration>,
+        message: String,
+    },
+    #[error("the API refuses this key")]
+    InvalidKey,
+    #[error("this key lacks the scope for the call")]
+    MissingScope,
+    /// The run does not exist: only the API's own 404 says so, an ingress's never does.
+    #[error("the run does not exist")]
+    NotFound,
+    /// Everything else: a network error, a proxy's answer, a 5xx. `api_message` is an `ApiError`
+    /// body's message.
+    #[error("{detail}")]
+    Unavailable {
+        status: Option<u16>,
+        api_message: Option<String>,
+        detail: String,
+    },
+}
+
+impl Error {
+    /// The variant's name, the bounded value of the metric's `error` label.
+    #[must_use]
+    pub fn name(&self) -> &'static str {
+        match self {
+            Self::Rejected { .. } => "Rejected",
+            Self::Conflict { .. } => "Conflict",
+            Self::RateLimited { .. } => "RateLimited",
+            Self::InvalidKey => "InvalidKey",
+            Self::MissingScope => "MissingScope",
+            Self::NotFound => "NotFound",
+            Self::Unavailable { .. } => "Unavailable",
+        }
+    }
+}
+
+/// A `url` or `caBundle` no client can be built from.
+#[derive(Debug, thiserror::Error)]
+#[error("{0}")]
+pub struct InvalidConnection(String);
+
+#[derive(Debug, Deserialize)]
+struct ApiError {
+    status: Option<u16>,
+    error: Option<String>,
+    message: Option<String>,
+    #[serde(default, rename = "fieldErrors")]
+    field_errors: BTreeMap<String, String>,
+}
+
+/// `TestResult.TaskStatus`; a status this build does not know reads as still running.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RunStatus {
+    Pending,
+    Running,
+    Done,
+    Failed,
+}
+
+impl RunStatus {
+    fn parse(status: &str) -> Self {
+        match status {
+            "PENDING" => Self::Pending,
+            "DONE" => Self::Done,
+            "FAILED" => Self::Failed,
+            _ => Self::Running,
+        }
+    }
+
+    #[must_use]
+    pub fn is_terminal(self) -> bool {
+        matches!(self, Self::Done | Self::Failed)
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct WireRun {
+    id: String,
+    status: String,
+    client_key: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Run {
+    pub id: String,
+    pub status: RunStatus,
+    pub client_key: Option<String>,
+}
+
+impl From<WireRun> for Run {
+    fn from(run: WireRun) -> Self {
+        Self {
+            status: RunStatus::parse(&run.status),
+            id: run.id,
+            client_key: run.client_key,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct Violation {
+    pub metric: String,
+    pub threshold: f64,
+    pub actual: f64,
+    pub reason: Option<String>,
+}
+
+impl std::fmt::Display for Violation {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match &self.reason {
+            Some(reason) => write!(f, "{}: {reason}", self.metric),
+            None => write!(
+                f,
+                "{}: {} against {}",
+                self.metric, self.actual, self.threshold
+            ),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct SlaVerdict {
+    pub passed: bool,
+    #[serde(default)]
+    pub violations: Vec<Violation>,
+}
+
+/// What the operator reads of `GET /api/tests/{id}/report`.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Report {
+    #[serde(default)]
+    pub summary: Value,
+    pub overall_sla_verdict: Option<SlaVerdict>,
+}
+
+#[derive(Debug, Clone, Default, Deserialize)]
+pub struct ComplianceSummary {
+    pub pass: i64,
+    pub fail: i64,
+    pub warn: i64,
+    pub waived: i64,
+    pub unknown: i64,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct ComplianceResult {
+    pub rule: String,
+    pub status: String,
+    pub detail: Option<String>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct ComplianceReport {
+    pub verdict: String,
+    #[serde(default)]
+    pub summary: ComplianceSummary,
+    #[serde(default)]
+    pub results: Vec<ComplianceResult>,
+}
+
+/// An answered check. `check_id` is absent when the API ran it but could not store the report.
+#[derive(Debug, Clone)]
+pub struct ComplianceAnswer {
+    pub report: ComplianceReport,
+    pub check_id: Option<String>,
+}
+
+/// One Kates API. The key travels per call, so a rotated key needs no new client.
+#[derive(Clone)]
+pub struct Client {
+    http: reqwest::Client,
+    base: String,
+    observer: Option<Observer>,
+}
+
+impl Client {
+    /// # Errors
+    /// When `url` does not parse, `ca_bundle` holds no certificate, or no client can be built.
+    pub fn new(url: &str, ca_bundle: Option<&[u8]>) -> Result<Self, InvalidConnection> {
+        let parsed = reqwest::Url::parse(url)
+            .map_err(|error| InvalidConnection(format!("url {url:?}: {error}")))?;
+        if !matches!(parsed.scheme(), "http" | "https") {
+            return Err(InvalidConnection(format!("url {url:?}: not http or https")));
+        }
+        let mut builder = reqwest::Client::builder()
+            .connect_timeout(CONNECT_TIMEOUT)
+            .timeout(REQUEST_TIMEOUT)
+            .redirect(redirect::Policy::none());
+        if let Some(pem) = ca_bundle {
+            let certificates = Certificate::from_pem_bundle(pem)
+                .map_err(|error| InvalidConnection(format!("caBundle: {error}")))?;
+            if certificates.is_empty() {
+                return Err(InvalidConnection("caBundle: no certificate".to_owned()));
+            }
+            builder = builder.tls_certs_merge(certificates);
+        }
+        let http = builder
+            .build()
+            .map_err(|error| InvalidConnection(error.to_string()))?;
+        Ok(Self {
+            http,
+            base: url.trim_end_matches('/').to_owned(),
+            observer: None,
+        })
+    }
+
+    #[must_use]
+    pub fn observed_by(mut self, observer: Observer) -> Self {
+        self.observer = Some(observer);
+        self
+    }
+
+    /// `GET /api/health`'s `capabilities`; an API older than the field lists none.
+    ///
+    /// # Errors
+    /// See [`Error`].
+    pub async fn capabilities(&self, key: &SecretString) -> Result<Vec<String>, Error> {
+        #[derive(Deserialize)]
+        struct Health {
+            #[serde(default)]
+            capabilities: Vec<String>,
+        }
+        let health: Health = self
+            .json(Method::GET, "/api/health", "/api/health", key, None, None)
+            .await?;
+        Ok(health.capabilities)
+    }
+
+    /// Starts a run, or finds the one `idempotency_key` already started.
+    ///
+    /// # Errors
+    /// See [`Error`].
+    pub async fn create_test(
+        &self,
+        key: &SecretString,
+        idempotency_key: &str,
+        request: &Value,
+    ) -> Result<Run, Error> {
+        let run: WireRun = self
+            .json(
+                Method::POST,
+                "/api/tests",
+                "/api/tests",
+                key,
+                Some(idempotency_key),
+                Some(request),
+            )
+            .await?;
+        Ok(run.into())
+    }
+
+    /// # Errors
+    /// See [`Error`].
+    pub async fn get_test(&self, key: &SecretString, id: &str) -> Result<Run, Error> {
+        let path = format!("/api/tests/{id}");
+        let run: WireRun = self
+            .json(Method::GET, "/api/tests/{id}", &path, key, None, None)
+            .await?;
+        Ok(run.into())
+    }
+
+    /// The run `client_key` created. An API older than the filter lists everything, so an item
+    /// counts only if it carries the key itself.
+    ///
+    /// # Errors
+    /// See [`Error`].
+    pub async fn find_by_client_key(
+        &self,
+        key: &SecretString,
+        client_key: &str,
+    ) -> Result<Option<Run>, Error> {
+        #[derive(Deserialize)]
+        struct Page {
+            #[serde(default)]
+            items: Vec<WireRun>,
+        }
+        let path = format!("/api/tests?clientKey={client_key}");
+        let page: Page = self
+            .json(Method::GET, "/api/tests", &path, key, None, None)
+            .await?;
+        Ok(page
+            .items
+            .into_iter()
+            .find(|run| run.client_key.as_deref() == Some(client_key))
+            .map(Run::from))
+    }
+
+    /// # Errors
+    /// `Conflict` when the run is not running. See [`Error`].
+    pub async fn cancel_test(&self, key: &SecretString, id: &str) -> Result<(), Error> {
+        let path = format!("/api/tests/{id}/cancel");
+        let _: Value = self
+            .json(
+                Method::POST,
+                "/api/tests/{id}/cancel",
+                &path,
+                key,
+                None,
+                None,
+            )
+            .await?;
+        Ok(())
+    }
+
+    /// # Errors
+    /// See [`Error`].
+    pub async fn report(&self, key: &SecretString, id: &str) -> Result<Report, Error> {
+        let path = format!("/api/tests/{id}/report");
+        self.json(
+            Method::GET,
+            "/api/tests/{id}/report",
+            &path,
+            key,
+            None,
+            None,
+        )
+        .await
+    }
+
+    /// Runs a compliance check. A stored report's id comes from the `Location` header.
+    ///
+    /// # Errors
+    /// See [`Error`].
+    pub async fn check_compliance(
+        &self,
+        key: &SecretString,
+        reference: &Value,
+    ) -> Result<ComplianceAnswer, Error> {
+        const ROUTE: &str = "/api/conformity/check";
+        let response = self
+            .call(Method::POST, ROUTE, ROUTE, key, None, Some(reference))
+            .await?;
+        let check_id = response
+            .headers()
+            .get(LOCATION)
+            .and_then(|location| location.to_str().ok())
+            .and_then(|location| location.rsplit('/').next())
+            .filter(|id| !id.is_empty())
+            .map(str::to_owned);
+        let report = decode(response).await?;
+        Ok(ComplianceAnswer { report, check_id })
+    }
+
+    async fn json<T: serde::de::DeserializeOwned>(
+        &self,
+        method: Method,
+        route: &'static str,
+        path: &str,
+        key: &SecretString,
+        idempotency_key: Option<&str>,
+        body: Option<&Value>,
+    ) -> Result<T, Error> {
+        decode(
+            self.call(method, route, path, key, idempotency_key, body)
+                .await?,
+        )
+        .await
+    }
+
+    async fn call(
+        &self,
+        method: Method,
+        route: &'static str,
+        path: &str,
+        key: &SecretString,
+        idempotency_key: Option<&str>,
+        body: Option<&Value>,
+    ) -> Result<Response, Error> {
+        let name = method_name(&method);
+        let mut request = self
+            .http
+            .request(method, format!("{}{path}", self.base))
+            .bearer_auth(key.expose_secret());
+        if let Some(idempotency_key) = idempotency_key {
+            request = request.header("Idempotency-Key", idempotency_key);
+        }
+        if let Some(body) = body {
+            request = request.json(body);
+        }
+        let response = request.send().await;
+        let status = response.as_ref().map_or(0, |r| r.status().as_u16());
+        if let Some(observer) = &self.observer {
+            observer(name, route, status);
+        }
+        let response = response.map_err(|error| Error::Unavailable {
+            status: None,
+            api_message: None,
+            // reqwest's text names neither the URL nor the headers here, so no key can reach it.
+            detail: chain(&error.without_url()),
+        })?;
+        if response.status().is_success() {
+            return Ok(response);
+        }
+        let status = response.status();
+        let headers = response.headers().clone();
+        let host = response.url().host_str().unwrap_or_default().to_owned();
+        let body = capped(response).await.unwrap_or_default();
+        let body = String::from_utf8_lossy(&body);
+        Err(classify(status, &headers, &body, &host))
+    }
+}
+
+// reqwest's own text is "error sending request"; the cause is at the end of its sources.
+fn chain(error: &dyn std::error::Error) -> String {
+    let mut text = error.to_string();
+    let mut source = error.source();
+    while let Some(cause) = source {
+        text = format!("{text}: {cause}");
+        source = cause.source();
+    }
+    text
+}
+
+async fn decode<T: serde::de::DeserializeOwned>(response: Response) -> Result<T, Error> {
+    let status = response.status().as_u16();
+    let unavailable = |detail| Error::Unavailable {
+        status: Some(status),
+        api_message: None,
+        detail: format!("an answer that is not the API's: {detail}"),
+    };
+    let body = capped(response).await.map_err(unavailable)?;
+    serde_json::from_slice(&body).map_err(|error| unavailable(error.to_string()))
+}
+
+// A kates-connection can name any host, and one huge answer would kill the pod every namespace
+// shares.
+async fn capped(mut response: Response) -> Result<Vec<u8>, String> {
+    let mut body = Vec::new();
+    while let Some(chunk) = response
+        .chunk()
+        .await
+        .map_err(|error| error.without_url().to_string())?
+    {
+        if body.len() + chunk.len() > MAX_BODY {
+            return Err(format!("over {MAX_BODY} bytes"));
+        }
+        body.extend_from_slice(&chunk);
+    }
+    Ok(body)
+}
+
+fn method_name(method: &Method) -> &'static str {
+    if *method == Method::GET {
+        "GET"
+    } else {
+        "POST"
+    }
+}
+
+// Section 4.8 of plans/operator.md; the first match wins. An ingress's HTML 404 on a live run is
+// an outage, never a RunGone, so only an ApiError body is believed.
+fn classify(status: StatusCode, headers: &HeaderMap, body: &str, host: &str) -> Error {
+    let api_error = serde_json::from_str::<ApiError>(body)
+        .ok()
+        .filter(|error| error.status.is_some() || error.error.is_some());
+    let message = || {
+        api_error
+            .as_ref()
+            .and_then(|error| error.message.clone())
+            .unwrap_or_default()
+    };
+    if status == StatusCode::TOO_MANY_REQUESTS {
+        return Error::RateLimited {
+            retry_after: headers
+                .get(RETRY_AFTER)
+                .and_then(|value| value.to_str().ok())
+                .and_then(|value| value.parse().ok())
+                .map(Duration::from_secs),
+            message: message(),
+        };
+    }
+    let unavailable = |api_message| Error::Unavailable {
+        status: Some(status.as_u16()),
+        api_message,
+        detail: format!("{host} answered {status}"),
+    };
+    let Some(error) = &api_error else {
+        return unavailable(None);
+    };
+    match status.as_u16() {
+        409 => Error::Conflict { message: message() },
+        401 => Error::InvalidKey,
+        403 if error.error.as_deref() == Some("Invalid API key") => Error::InvalidKey,
+        403 => Error::MissingScope,
+        404 if error.status == Some(404) && message().starts_with("Test run not found") => {
+            Error::NotFound
+        }
+        400..=499 => Error::Rejected {
+            status: status.as_u16(),
+            message: message(),
+            field_errors: error.field_errors.clone(),
+        },
+        _ => unavailable(error.message.clone()),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+    use wiremock::matchers::{header, method, path, query_param};
+    use wiremock::{Mock, MockServer, ResponseTemplate};
+
+    use super::*;
+
+    fn key() -> SecretString {
+        SecretString::from("the-key")
+    }
+
+    fn client(server: &MockServer) -> Client {
+        Client::new(&server.uri(), None).unwrap()
+    }
+
+    fn api_error(status: u16, error: &str, message: &str) -> ResponseTemplate {
+        ResponseTemplate::new(status)
+            .set_body_json(json!({"status": status, "error": error, "message": message}))
+    }
+
+    async fn answering(response: ResponseTemplate) -> Error {
+        let server = MockServer::start().await;
+        Mock::given(method("GET"))
+            .respond_with(response)
+            .mount(&server)
+            .await;
+        client(&server).get_test(&key(), "r").await.unwrap_err()
+    }
+
+    #[tokio::test]
+    async fn create_sends_the_key_and_the_idempotency_key() {
+        let server = MockServer::start().await;
+        Mock::given(method("POST"))
+            .and(path("/prefix/api/tests"))
+            .and(header("authorization", "Bearer the-key"))
+            .and(header("idempotency-key", "uid-1"))
+            .respond_with(ResponseTemplate::new(202).set_body_json(
+                json!({"id": "r1", "status": "PENDING", "clientKey": "uid-1", "results": []}),
+            ))
+            .expect(1)
+            .mount(&server)
+            .await;
+
+        let url = format!("{}/prefix/", server.uri());
+        let run = Client::new(&url, None)
+            .unwrap()
+            .create_test(&key(), "uid-1", &json!({"type": "LOAD"}))
+            .await
+            .unwrap();
+        assert_eq!(run.id, "r1");
+        assert_eq!(run.status, RunStatus::Pending);
+        assert_eq!(run.client_key.as_deref(), Some("uid-1"));
+    }
+
+    #[tokio::test]
+    async fn an_older_api_that_lists_everything_finds_nothing() {
+        let server = MockServer::start().await;
+        Mock::given(method("GET"))
+            .and(path("/api/tests"))
+            .and(query_param("clientKey", "uid-1"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(
+                json!({"items": [{"id": "other", "status": "RUNNING"}], "total": 1}),
+            ))
+            .mount(&server)
+            .await;
+        let found = client(&server).find_by_client_key(&key(), "uid-1").await;
+        assert_eq!(found, Ok(None));
+    }
+
+    #[tokio::test]
+    async fn the_engine_full_answer_carries_retry_after() {
+        let error = answering(
+            api_error(429, "Too Many Requests", "engine full").insert_header("Retry-After", "30"),
+        )
+        .await;
+        assert_eq!(
+            error,
+            Error::RateLimited {
+                retry_after: Some(Duration::from_secs(30)),
+                message: "engine full".to_owned()
+            }
+        );
+    }
+
+    #[tokio::test]
+    async fn only_the_apis_own_404_means_the_run_is_gone() {
+        let gone = answering(api_error(404, "Not Found", "Test run not found: r")).await;
+        assert_eq!(gone, Error::NotFound);
+
+        let other = answering(api_error(404, "Not Found", "HTTP 404 Not Found")).await;
+        assert_eq!(other.name(), "Rejected");
+
+        let ingress = answering(ResponseTemplate::new(404).set_body_string("<html>")).await;
+        assert_eq!(ingress.name(), "Unavailable");
+    }
+
+    #[tokio::test]
+    async fn refused_keys_are_told_apart() {
+        let invalid = answering(api_error(403, "Invalid API key", "m")).await;
+        assert_eq!(invalid, Error::InvalidKey);
+        let unauthorized = answering(api_error(401, "Unauthorized", "m")).await;
+        assert_eq!(unauthorized, Error::InvalidKey);
+        let scope = answering(api_error(403, "Forbidden", "m")).await;
+        assert_eq!(scope, Error::MissingScope);
+    }
+
+    #[tokio::test]
+    async fn field_errors_and_conflicts_keep_the_apis_message() {
+        let rejected = answering(
+            ResponseTemplate::new(400).set_body_json(json!({"status": 400, "error":
+                "Validation Failed", "message": "bad", "fieldErrors": {"spec.acks": "no"}})),
+        )
+        .await;
+        let Error::Rejected { field_errors, .. } = rejected else {
+            panic!("{rejected:?}");
+        };
+        assert_eq!(field_errors["spec.acks"], "no");
+
+        let conflict = answering(api_error(409, "Conflict", "Test is not running")).await;
+        assert_eq!(
+            conflict,
+            Error::Conflict {
+                message: "Test is not running".to_owned()
+            }
+        );
+    }
+
+    #[tokio::test]
+    async fn a_503_keeps_the_apis_message_and_a_proxy_has_none() {
+        let api = answering(api_error(503, "Service Unavailable", "kubernetes down")).await;
+        let Error::Unavailable { api_message, .. } = api else {
+            panic!("{api:?}");
+        };
+        assert_eq!(api_message.as_deref(), Some("kubernetes down"));
+
+        let proxy = answering(ResponseTemplate::new(503).set_body_string("upstream")).await;
+        let Error::Unavailable { api_message, .. } = proxy else {
+            panic!("{proxy:?}");
+        };
+        assert_eq!(api_message, None);
+    }
+
+    #[tokio::test]
+    async fn an_answer_over_the_cap_is_an_outage() {
+        let error =
+            answering(ResponseTemplate::new(200).set_body_bytes(vec![b' '; MAX_BODY + 1])).await;
+        assert_eq!(error.name(), "Unavailable");
+        assert!(error.to_string().contains("over"), "{error}");
+    }
+
+    #[tokio::test]
+    async fn a_redirect_is_an_outage_and_not_followed() {
+        let error = answering(ResponseTemplate::new(302).insert_header("Location", "/x")).await;
+        assert_eq!(error.name(), "Unavailable");
+    }
+
+    #[tokio::test]
+    async fn the_check_id_comes_from_location_and_a_lost_report_has_none() {
+        let body = json!({"verdict": "FAIL", "summary": {"pass": 1, "fail": 1, "warn": 0,
+            "waived": 0, "unknown": 0}, "results": [{"rule": "kafka.replicas.min",
+            "status": "FAIL", "detail": "2 < 3"}]});
+        let server = MockServer::start().await;
+        Mock::given(method("POST"))
+            .and(path("/api/conformity/check"))
+            .respond_with(
+                ResponseTemplate::new(200)
+                    .set_body_json(&body)
+                    .insert_header("Location", "/api/conformity/checks/c1"),
+            )
+            .up_to_n_times(1)
+            .mount(&server)
+            .await;
+        Mock::given(method("POST"))
+            .and(path("/api/conformity/check"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(&body))
+            .mount(&server)
+            .await;
+
+        let client = client(&server);
+        let stored = client.check_compliance(&key(), &json!({})).await.unwrap();
+        assert_eq!(stored.check_id.as_deref(), Some("c1"));
+        assert_eq!(stored.report.summary.fail, 1);
+        let lost = client.check_compliance(&key(), &json!({})).await.unwrap();
+        assert_eq!(lost.check_id, None);
+    }
+
+    #[tokio::test]
+    async fn the_observer_gets_the_route_template_and_never_the_url() {
+        let seen = Arc::new(std::sync::Mutex::new(Vec::new()));
+        let sink = seen.clone();
+        let server = MockServer::start().await;
+        Mock::given(method("GET"))
+            .respond_with(
+                ResponseTemplate::new(200)
+                    .set_body_json(json!({"id": "secret-id", "status": "DONE"})),
+            )
+            .mount(&server)
+            .await;
+        client(&server)
+            .observed_by(Arc::new(move |m, r, s| {
+                sink.lock().unwrap().push((m, r, s));
+            }))
+            .get_test(&key(), "secret-id")
+            .await
+            .unwrap();
+        assert_eq!(*seen.lock().unwrap(), [("GET", "/api/tests/{id}", 200)]);
+    }
+
+    #[tokio::test]
+    async fn a_network_error_says_why() {
+        let client = Client::new("http://127.0.0.1:1", None).unwrap();
+        let error = client.get_test(&key(), "r").await.unwrap_err();
+        let Error::Unavailable { status, detail, .. } = error else {
+            panic!("{error:?}");
+        };
+        assert_eq!(status, None);
+        assert!(detail.to_lowercase().contains("refused"), "{detail}");
+    }
+
+    #[test]
+    fn a_bad_url_or_bundle_is_an_invalid_connection() {
+        assert!(Client::new("not a url", None).is_err());
+        assert!(Client::new("ftp://kates", None).is_err());
+        assert!(Client::new("https://kates", Some(b"no certificate")).is_err());
+    }
+}
diff --git a/operator/crates/kates-crds/src/kafkacompliance.rs b/operator/crates/kates-crds/src/kafkacompliance.rs
new file mode 100644
index 00000000..07693c84
--- /dev/null
+++ b/operator/crates/kates-crds/src/kafkacompliance.rs
@@ -0,0 +1,100 @@
+use k8s_openapi::apimachinery::pkg::apis::meta::v1::{Condition, Time};
+use kube::{CustomResource, KubeSchema};
+use schemars::{JsonSchema, Schema, SchemaGenerator, json_schema};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+/// A standing compliance check of one Kafka.
+#[derive(CustomResource, KubeSchema, Serialize, Deserialize, Clone, Debug)]
+#[kube(
+    group = "kates.io",
+    version = "v1alpha1",
+    kind = "KafkaCompliance",
+    namespaced,
+    status = "KafkaComplianceStatus",
+    doc = "A standing compliance check of one Kafka. crd-version: 1",
+    cel,
+    validation = Rule::new("self.metadata.name.matches('^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$')")
+        .message("name must be a DNS label (at most 63 lower-case letters, digits and -): it names the stored compliance check"),
+    printcolumn = r#"{"name":"Verdict","type":"string","jsonPath":".status.verdict"}"#,
+    printcolumn = r#"{"name":"Checked","type":"date","jsonPath":".status.checkedAt"}"#,
+    printcolumn = r#"{"name":"Age","type":"date","jsonPath":".metadata.creationTimestamp"}"#
+)]
+#[serde(rename_all = "camelCase")]
+pub struct KafkaComplianceSpec {
+    /// A `KafkaReference` `.spec`, inline; its target names the Kafka.
+    #[schemars(schema_with = "reference")]
+    pub reference: Value,
+    /// How often to check, such as 30m or 1h.
+    #[schemars(regex(pattern = r"^([0-9]+(s|m|h))+$"))]
+    pub interval: String,
+    /// Stops new checks without touching what the last one found.
+    #[serde(default)]
+    pub suspend: bool,
+}
+
+// Pruning resumes at every declared property, so target keeps the flag too: without it the
+// apiserver would drop clusterId, platform or a mistyped key before the strict reader sees them.
+fn reference(_: &mut SchemaGenerator) -> Schema {
+    json_schema!({
+        "type": "object",
+        "x-kubernetes-preserve-unknown-fields": true,
+        "required": ["target"],
+        "properties": {
+            "target": {
+                "type": "object",
+                "x-kubernetes-preserve-unknown-fields": true,
+                "required": ["namespace", "name"],
+                "properties": {
+                    "namespace": {"type": "string"},
+                    "name": {"type": "string"},
+                },
+            },
+        },
+    })
+}
+
+#[derive(Serialize, Deserialize, JsonSchema, Clone, Debug, Default, PartialEq, Eq)]
+pub struct ComplianceCounts {
+    pub pass: i64,
+    pub fail: i64,
+    pub unknown: i64,
+}
+
+#[derive(Serialize, Deserialize, JsonSchema, Clone, Debug, PartialEq, Eq)]
+pub struct FailedRule {
+    pub rule: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub detail: Option<String>,
+}
+
+#[derive(KubeSchema, Serialize, Deserialize, Clone, Debug, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct KafkaComplianceStatus {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub observed_generation: Option<i64>,
+    /// PASS, FAIL or UNKNOWN.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub verdict: Option<String>,
+    /// `/api/conformity/checks/{id}`; absent when the API kept no report.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub check_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub checked_at: Option<Time>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub next_check_at: Option<Time>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub counts: Option<ComplianceCounts>,
+    /// At most 20; the report has the rest.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub failed: Vec<FailedRule>,
+    /// The Kafka's `status.observedGeneration` at the last answered check.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub observed_kafka_generation: Option<i64>,
+    /// The `kates.io/reconcile-at` value last acted on.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub last_handled_reconcile_at: Option<String>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    #[x_kube(merge_strategy = ListMerge::Map(vec!["type".into()]))]
+    pub conditions: Vec<Condition>,
+}
diff --git a/operator/crates/kates-crds/src/lib.rs b/operator/crates/kates-crds/src/lib.rs
index d538d084..e7e86b69 100644
--- a/operator/crates/kates-crds/src/lib.rs
+++ b/operator/crates/kates-crds/src/lib.rs
@@ -1,15 +1,55 @@
 //! The custom resources of `kates.io/v1alpha1`.
 
+mod kafkacompliance;
 mod katestest;
 mod wire;
 
 use k8s_openapi::apiextensions_apiserver::pkg::apis::apiextensions::v1::CustomResourceDefinition;
 use kube::CustomResourceExt;
 
+pub use kafkacompliance::{
+    ComplianceCounts, FailedRule, KafkaCompliance, KafkaComplianceSpec, KafkaComplianceStatus,
+};
 pub use katestest::{KatesTest, KatesTestSpec, KatesTestStatus, Phase, RunSummary, TestType};
 
-/// Every CRD this build carries, for `crdgen`.
+/// Every CRD this build carries, for `crdgen` and `crds apply`.
 #[must_use]
 pub fn crds() -> Vec<CustomResourceDefinition> {
-    vec![KatesTest::crd()]
+    vec![KatesTest::crd(), KafkaCompliance::crd()]
+}
+
+/// The `crd-version: <N>` a root schema's description ends in.
+#[must_use]
+pub fn crd_version(description: &str) -> Option<u32> {
+    description
+        .rsplit("crd-version: ")
+        .next()?
+        .trim()
+        .parse()
+        .ok()
+}
+
+/// A CRD's marker, from its first version's root schema.
+#[must_use]
+pub fn marker(crd: &CustomResourceDefinition) -> Option<u32> {
+    let schema = crd.spec.versions.first()?.schema.as_ref()?;
+    crd_version(schema.open_api_v3_schema.as_ref()?.description.as_deref()?)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{crd_version, crds, marker};
+
+    #[test]
+    fn the_marker_ends_the_description() {
+        assert_eq!(crd_version("One Kates run. crd-version: 12"), Some(12));
+        assert_eq!(crd_version("One Kates run."), None);
+    }
+
+    #[test]
+    fn every_crd_carries_a_marker() {
+        for crd in crds() {
+            assert!(marker(&crd).is_some(), "{:?}", crd.metadata.name);
+        }
+    }
 }
diff --git a/operator/crates/kates-crds/tests/kafkacompliance.rs b/operator/crates/kates-crds/tests/kafkacompliance.rs
new file mode 100644
index 00000000..cb84d10d
--- /dev/null
+++ b/operator/crates/kates-crds/tests/kafkacompliance.rs
@@ -0,0 +1,42 @@
+use kates_crds::{KafkaCompliance, KafkaComplianceSpec};
+use kube::CustomResourceExt;
+use serde_json::{Value, json};
+
+fn spec() -> KafkaComplianceSpec {
+    serde_json::from_value(json!({
+        "reference": {"target": {"namespace": "kafka", "name": "krafter", "clusterId": "x"}},
+        "interval": "1h",
+    }))
+    .unwrap()
+}
+
+fn schema() -> Value {
+    let crd = serde_json::to_value(KafkaCompliance::crd()).unwrap();
+    crd["spec"]["versions"][0]["schema"]["openAPIV3Schema"].clone()
+}
+
+#[test]
+fn a_dns_label_name_passes_and_others_are_refused() {
+    let good = KafkaCompliance::new("krafter-rules", spec());
+    assert!(good.validate_cel().is_ok());
+    for name in ["a.b", "UPPER", &"x".repeat(64)] {
+        let bad = KafkaCompliance::new(name, spec());
+        assert!(bad.validate_cel().is_err(), "{name}");
+    }
+}
+
+#[test]
+fn unknown_keys_reach_the_strict_reader_at_both_levels() {
+    let reference = &schema()["properties"]["spec"]["properties"]["reference"];
+    assert_eq!(reference["x-kubernetes-preserve-unknown-fields"], true);
+    assert_eq!(reference["required"], json!(["target"]));
+    let target = &reference["properties"]["target"];
+    assert_eq!(target["x-kubernetes-preserve-unknown-fields"], true);
+    assert_eq!(target["required"], json!(["name", "namespace"]));
+}
+
+#[test]
+fn the_interval_is_checked_by_the_schema() {
+    let interval = &schema()["properties"]["spec"]["properties"]["interval"];
+    assert!(interval["pattern"].as_str().unwrap().starts_with('^'));
+}
diff --git a/operator/crates/kates-operator/Cargo.toml b/operator/crates/kates-operator/Cargo.toml
new file mode 100644
index 00000000..e5982bfe
--- /dev/null
+++ b/operator/crates/kates-operator/Cargo.toml
@@ -0,0 +1,41 @@
+[package]
+name = "kates-operator"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[features]
+telemetry = ["dep:opentelemetry-otlp"]
+
+[dependencies]
+kates-client = { path = "../kates-client" }
+kates-crds = { path = "../kates-crds" }
+futures = "0.3"
+http = "1"
+jiff = "0.2"
+json-patch = "4"
+kube-lease-manager = "0.13"
+secrecy = "0.10"
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+axum = { version = "0.8", default-features = false, features = ["http1", "tokio"] }
+# k8s-openapi refuses to build unless the binary names a Kubernetes version.
+k8s-openapi.workspace = true
+kube.workspace = true
+opentelemetry = { version = "0.33", default-features = false, features = ["trace"] }
+opentelemetry-otlp = { version = "0.33", default-features = false, features = ["grpc-tonic", "tls-aws-lc", "trace"], optional = true }
+opentelemetry_sdk = { version = "0.33", default-features = false, features = ["trace"] }
+prometheus-client = "0.25"
+rustls = "0.23"
+tokio = { version = "1", features = ["fs", "macros", "net", "rt-multi-thread", "signal", "sync", "time"] }
+tracing = "0.1"
+tracing-opentelemetry = { version = "0.34", default-features = false }
+tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
+
+[dev-dependencies]
+tower-test = "0.4"
+
+[lints]
+workspace = true
diff --git a/operator/crates/kates-operator/src/connection.rs b/operator/crates/kates-operator/src/connection.rs
new file mode 100644
index 00000000..8bae21e1
--- /dev/null
+++ b/operator/crates/kates-operator/src/connection.rs
@@ -0,0 +1,200 @@
+//! Where a resource's Kates API and key come from: the Secret `kates-connection` in its own
+//! namespace, else the operator's own connection, a file mounted when `connection.fallback` is on.
+
+use std::collections::HashMap;
+use std::hash::{DefaultHasher, Hash, Hasher};
+use std::path::PathBuf;
+use std::sync::Mutex;
+
+use k8s_openapi::api::core::v1::Secret;
+use kates_client::{Client, Observer};
+use kube::Api;
+use secrecy::SecretString;
+
+pub const SECRET: &str = "kates-connection";
+pub const FALLBACK_DIR: &str = "/etc/kates-operator/connection";
+// Each Secret edit can name a new url, so one namespace could otherwise grow the cache for good.
+const MAX_CLIENTS: usize = 256;
+
+pub struct Connection {
+    pub api: Client,
+    pub key: SecretString,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum Failure {
+    #[error("no Secret {SECRET} in this namespace and no operator connection")]
+    Missing,
+    #[error("{0}")]
+    Invalid(String),
+    #[error(transparent)]
+    Kube(#[from] kube::Error),
+}
+
+struct Fields {
+    url: String,
+    key: String,
+    ca_bundle: Option<Vec<u8>>,
+}
+
+/// One client per (url, caBundle), rebuilt on a change; the key is read on every pass, so a rotated
+/// one needs no restart.
+pub struct Connections {
+    clients: Mutex<HashMap<(String, u64), Client>>,
+    fallback: PathBuf,
+    observer: Observer,
+}
+
+impl Connections {
+    #[must_use]
+    pub fn new(fallback: PathBuf, observer: Observer) -> Self {
+        Self {
+            clients: Mutex::default(),
+            fallback,
+            observer,
+        }
+    }
+
+    /// # Errors
+    /// `Missing` with neither source, `Invalid` when no client can be built from one.
+    pub async fn resolve(
+        &self,
+        kube: &kube::Client,
+        namespace: &str,
+    ) -> Result<Connection, Failure> {
+        let secrets: Api<Secret> = Api::namespaced(kube.clone(), namespace);
+        let fields = match secrets.get_opt(SECRET).await? {
+            Some(secret) => from_secret(&secret)?,
+            None => self.read_files().await?,
+        };
+        let api = self.client(&fields)?;
+        Ok(Connection {
+            api,
+            key: SecretString::from(fields.key),
+        })
+    }
+
+    async fn read_files(&self) -> Result<Fields, Failure> {
+        let read = |name: &str| tokio::fs::read(self.fallback.join(name));
+        let Ok(key) = read("apiKey").await else {
+            return Err(Failure::Missing);
+        };
+        let url = read("url")
+            .await
+            .map_err(|_| Failure::Invalid("the operator connection has no url".to_owned()))?;
+        Ok(Fields {
+            url: text(&url, "url")?,
+            key: text(&key, "apiKey")?,
+            ca_bundle: read("caBundle").await.ok(),
+        })
+    }
+
+    fn client(&self, fields: &Fields) -> Result<Client, Failure> {
+        let mut hasher = DefaultHasher::new();
+        fields.ca_bundle.hash(&mut hasher);
+        let cache_key = (fields.url.clone(), hasher.finish());
+        let mut clients = self.clients.lock().expect("the client cache");
+        if let Some(client) = clients.get(&cache_key) {
+            return Ok(client.clone());
+        }
+        let client = Client::new(&fields.url, fields.ca_bundle.as_deref())
+            .map_err(|error| Failure::Invalid(error.to_string()))?
+            .observed_by(self.observer.clone());
+        if clients.len() >= MAX_CLIENTS {
+            clients.clear();
+        }
+        clients.insert(cache_key, client.clone());
+        Ok(client)
+    }
+}
+
+fn from_secret(secret: &Secret) -> Result<Fields, Failure> {
+    let data = secret.data.as_ref();
+    let field = |name: &str| data.and_then(|data| data.get(name)).map(|value| &value.0);
+    let required = |name: &str| {
+        field(name)
+            .ok_or_else(|| Failure::Invalid(format!("Secret {SECRET} has no key {name}")))
+            .and_then(|value| text(value, name))
+    };
+    Ok(Fields {
+        url: required("url")?,
+        key: required("apiKey")?,
+        ca_bundle: field("caBundle").cloned(),
+    })
+}
+
+fn text(value: &[u8], name: &str) -> Result<String, Failure> {
+    let text = std::str::from_utf8(value)
+        .map_err(|_| Failure::Invalid(format!("{name} is not text")))?
+        .trim();
+    if text.is_empty() {
+        return Err(Failure::Invalid(format!("{name} is empty")));
+    }
+    Ok(text.to_owned())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use k8s_openapi::ByteString;
+
+    use super::*;
+
+    fn secret(keys: &[(&str, &str)]) -> Secret {
+        let data: BTreeMap<_, _> = keys
+            .iter()
+            .map(|(k, v)| ((*k).to_owned(), ByteString(v.as_bytes().to_vec())))
+            .collect();
+        Secret {
+            data: Some(data),
+            ..Secret::default()
+        }
+    }
+
+    #[test]
+    fn a_secret_needs_a_url_and_a_key() {
+        let fields = from_secret(&secret(&[("url", "http://k\n"), ("apiKey", "a")])).unwrap();
+        assert_eq!(fields.url, "http://k");
+        assert!(matches!(
+            from_secret(&secret(&[("url", "http://k")])),
+            Err(Failure::Invalid(message)) if message.contains("apiKey")
+        ));
+        assert!(matches!(
+            from_secret(&secret(&[("url", " "), ("apiKey", "a")])),
+            Err(Failure::Invalid(_))
+        ));
+    }
+
+    #[tokio::test]
+    async fn no_file_is_no_connection_and_a_rotated_file_is_read_again() {
+        let dir = std::env::temp_dir().join(format!("kates-operator-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let connections = Connections::new(dir.clone(), std::sync::Arc::new(|_, _, _| {}));
+        assert!(matches!(
+            connections.read_files().await,
+            Err(Failure::Missing)
+        ));
+
+        std::fs::write(dir.join("apiKey"), "first").unwrap();
+        std::fs::write(dir.join("url"), "http://k").unwrap();
+        assert_eq!(connections.read_files().await.unwrap().key, "first");
+        std::fs::write(dir.join("apiKey"), "second").unwrap();
+        assert_eq!(connections.read_files().await.unwrap().key, "second");
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn the_client_cache_stays_bounded() {
+        let connections = Connections::new(PathBuf::new(), std::sync::Arc::new(|_, _, _| {}));
+        for port in 0..=MAX_CLIENTS {
+            let fields = Fields {
+                url: format!("http://kates:{port}"),
+                key: "k".to_owned(),
+                ca_bundle: None,
+            };
+            connections.client(&fields).unwrap();
+        }
+        assert_eq!(connections.clients.lock().unwrap().len(), 1);
+    }
+}
diff --git a/operator/crates/kates-operator/src/context.rs b/operator/crates/kates-operator/src/context.rs
new file mode 100644
index 00000000..485356d8
--- /dev/null
+++ b/operator/crates/kates-operator/src/context.rs
@@ -0,0 +1,80 @@
+use std::collections::BTreeSet;
+
+use kube::Client;
+use kube::core::ApiResource;
+use kube::runtime::events::{Event, EventType, Recorder};
+
+use crate::connection::Connections;
+use crate::metrics::Metrics;
+
+/// What a reconciler is handed.
+pub struct Context {
+    pub client: Client,
+    pub recorder: Recorder,
+    pub metrics: Metrics,
+    pub connections: Connections,
+    pub field_manager: String,
+    /// `None` without the Strimzi CRD: compliance then runs on its interval only.
+    pub kafka: Option<KafkaWatch>,
+}
+
+/// The namespaces whose `Kafka`s trigger a check, fixed at start.
+pub struct KafkaWatch {
+    pub resource: ApiResource,
+    pub any_namespace: bool,
+    pub namespaces: BTreeSet<String>,
+    pub refused: BTreeSet<String>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Watched {
+    Yes,
+    NotConfigured,
+    Forbidden,
+}
+
+impl KafkaWatch {
+    #[must_use]
+    pub fn watched(&self, namespace: &str) -> Watched {
+        if self.refused.contains(namespace) {
+            Watched::Forbidden
+        } else if self.any_namespace || self.namespaces.contains(namespace) {
+            Watched::Yes
+        } else {
+            Watched::NotConfigured
+        }
+    }
+}
+
+/// One transition worth telling `kubectl describe`.
+pub struct Note {
+    pub warning: bool,
+    pub reason: &'static str,
+    pub message: String,
+}
+
+impl Context {
+    /// Never fails a pass: a terminating namespace refuses new objects, Events included.
+    pub async fn publish<K>(&self, object: &K, notes: Vec<Note>)
+    where
+        K: kube::Resource<DynamicType = ()>,
+    {
+        let reference = object.object_ref(&());
+        for note in notes {
+            let event = Event {
+                type_: if note.warning {
+                    EventType::Warning
+                } else {
+                    EventType::Normal
+                },
+                reason: note.reason.to_owned(),
+                note: Some(note.message),
+                action: "Reconcile".to_owned(),
+                secondary: None,
+            };
+            if let Err(error) = self.recorder.publish(&event, &reference).await {
+                tracing::warn!(%error, name = ?reference.name, "event refused");
+            }
+        }
+    }
+}
diff --git a/operator/crates/kates-operator/src/crds.rs b/operator/crates/kates-operator/src/crds.rs
new file mode 100644
index 00000000..678b3cac
--- /dev/null
+++ b/operator/crates/kates-operator/src/crds.rs
@@ -0,0 +1,122 @@
+//! `kates-operator crds apply`, the Helm hook's writer, and the check that the served CRDs are at
+//! least this build's.
+
+use std::collections::BTreeMap;
+use std::time::Duration;
+
+use k8s_openapi::apiextensions_apiserver::pkg::apis::apiextensions::v1::CustomResourceDefinition;
+use kates_crds::{crd_version, crds, marker};
+use kube::api::{Api, Patch, PatchParams};
+use kube::runtime::wait::{await_condition, conditions};
+use kube::{Client, Resource as _};
+use serde_json::Value;
+
+const FIELD_MANAGER: &str = "kates-operator-crd-upgrade";
+const ESTABLISH_TIMEOUT: Duration = Duration::from_mins(1);
+const OPENAPI: &str = "/openapi/v3/apis/kates.io/v1alpha1";
+
+/// Whether to apply over a live CRD: never over a strictly newer one, so with several releases on
+/// a cluster the newest wins. Equal applies, which gives the hook co-ownership of every field.
+#[must_use]
+pub fn should_apply(live: Option<u32>, own: Option<u32>) -> bool {
+    match (live, own) {
+        (Some(live), Some(own)) => live <= own,
+        _ => true,
+    }
+}
+
+/// Applies every CRD this build carries and waits for each to be Established.
+///
+/// # Errors
+/// A refused apply, or a CRD not Established in time.
+pub async fn apply(client: Client) -> Result<(), Box<dyn std::error::Error>> {
+    let api: Api<CustomResourceDefinition> = Api::all(client);
+    for crd in crds() {
+        let name = crd.meta().name.clone().ok_or("a CRD without a name")?;
+        let live = api.get_opt(&name).await?;
+        if !should_apply(live.as_ref().and_then(marker), marker(&crd)) {
+            println!("{name}: a newer version is installed, left alone");
+            continue;
+        }
+        let params = PatchParams::apply(FIELD_MANAGER).force();
+        api.patch(&name, &params, &Patch::Apply(&crd)).await?;
+        let established = await_condition(api.clone(), &name, conditions::is_crd_established());
+        tokio::time::timeout(ESTABLISH_TIMEOUT, established).await??;
+        println!("{name}: applied");
+    }
+    Ok(())
+}
+
+/// `crd-version` of each kind the API server serves, from its `OpenAPI` document.
+///
+/// # Errors
+/// A read that failed: the group not being served reads as an empty map.
+pub async fn served(client: &Client) -> Result<BTreeMap<String, u32>, kube::Error> {
+    let request = http::Request::get(OPENAPI)
+        .body(Vec::new())
+        .map_err(|error| {
+            kube::Error::BuildRequest(kube::core::request::Error::BuildRequest(error))
+        })?;
+    match client.request_text(request).await {
+        Ok(text) => Ok(parse_served(&text)),
+        Err(kube::Error::Api(status)) if status.code == 404 => Ok(BTreeMap::new()),
+        Err(error) => Err(error),
+    }
+}
+
+fn parse_served(text: &str) -> BTreeMap<String, u32> {
+    let document: Value = serde_json::from_str(text).unwrap_or_default();
+    let schemas = document["components"]["schemas"].as_object();
+    schemas
+        .into_iter()
+        .flatten()
+        .filter_map(|(key, schema)| {
+            let kind = key.strip_prefix("io.kates.v1alpha1.")?;
+            let version = crd_version(schema["description"].as_str()?)?;
+            Some((kind.to_owned(), version))
+        })
+        .collect()
+}
+
+/// What `/readyz` says when a served CRD is behind this build, or `None` when none is.
+#[must_use]
+pub fn stale(served: &BTreeMap<String, u32>) -> Option<String> {
+    crds().iter().find_map(|crd| {
+        let kind = &crd.spec.names.kind;
+        let own = marker(crd)?;
+        let behind = served.get(kind).is_none_or(|version| *version < own);
+        behind.then(|| {
+            format!("{kind} is not served at crd-version {own}: run kates-operator crds apply, or helm upgrade")
+        })
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_newer_crd_is_never_downgraded() {
+        assert!(should_apply(None, Some(2)));
+        assert!(should_apply(Some(1), Some(2)));
+        assert!(should_apply(Some(2), Some(2)));
+        assert!(!should_apply(Some(3), Some(2)));
+    }
+
+    #[test]
+    fn staleness_reads_the_served_markers() {
+        let text = r#"{"components":{"schemas":{
+            "io.kates.v1alpha1.KatesTest":{"description":"One Kates run. crd-version: 1"},
+            "io.kates.v1alpha1.KafkaCompliance":{"description":"A check. crd-version: 1"},
+            "io.k8s.other":{"description":"x"}}}}"#;
+        let served = parse_served(text);
+        assert_eq!(served.len(), 2);
+        assert_eq!(stale(&served), None);
+    }
+
+    #[test]
+    fn a_kind_not_served_is_stale_and_says_what_to_run() {
+        let message = stale(&BTreeMap::new()).unwrap();
+        assert!(message.contains("crds apply"));
+    }
+}
diff --git a/operator/crates/kates-operator/src/lib.rs b/operator/crates/kates-operator/src/lib.rs
new file mode 100644
index 00000000..da8ed304
--- /dev/null
+++ b/operator/crates/kates-operator/src/lib.rs
@@ -0,0 +1,10 @@
+//! The Kates operator: `KatesTest` and `KafkaCompliance`, driving the Kates REST API.
+
+pub mod connection;
+pub mod context;
+pub mod crds;
+pub mod metrics;
+pub mod reconcile;
+pub mod run;
+pub mod status;
+pub mod telemetry;
diff --git a/operator/crates/kates-operator/src/main.rs b/operator/crates/kates-operator/src/main.rs
new file mode 100644
index 00000000..cdcddaae
--- /dev/null
+++ b/operator/crates/kates-operator/src/main.rs
@@ -0,0 +1,16 @@
+use kates_operator::{crds, run, telemetry};
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    // rustls panics at the first handshake unless the provider is named.
+    rustls::crypto::aws_lc_rs::default_provider()
+        .install_default()
+        .expect("crypto provider");
+    telemetry::init();
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    match args.iter().map(String::as_str).collect::<Vec<_>>()[..] {
+        [] | ["run"] => run::run().await,
+        ["crds", "apply"] => crds::apply(kube::Client::try_default().await?).await,
+        _ => Err("usage: kates-operator [run | crds apply]".into()),
+    }
+}
diff --git a/operator/crates/kates-operator/src/metrics.rs b/operator/crates/kates-operator/src/metrics.rs
new file mode 100644
index 00000000..3937ca64
--- /dev/null
+++ b/operator/crates/kates-operator/src/metrics.rs
@@ -0,0 +1,281 @@
+use std::sync::{Arc, RwLock};
+use std::time::{Instant, SystemTime};
+
+use kates_crds::{KafkaCompliance, KatesTest, Phase};
+use kube::ResourceExt as _;
+use kube::runtime::reflector::Store;
+
+use opentelemetry::trace::TraceId;
+use prometheus_client::collector::Collector;
+use prometheus_client::encoding::{DescriptorEncoder, EncodeLabelSet, EncodeMetric as _};
+use prometheus_client::metrics::counter::Counter;
+use prometheus_client::metrics::exemplar::HistogramWithExemplars;
+use prometheus_client::metrics::family::Family;
+use prometheus_client::metrics::gauge::{ConstGauge, Gauge};
+use prometheus_client::registry::{Registry, Unit};
+
+const BUCKETS: [f64; 9] = [0.01, 0.05, 0.1, 0.5, 1.0, 5.0, 15.0, 30.0, 60.0];
+
+#[derive(Clone, Debug, Hash, PartialEq, Eq, EncodeLabelSet)]
+struct KindLabel {
+    kind: &'static str,
+}
+
+// error is a variant or reason name, never Debug or Display text: the label stays bounded.
+#[derive(Clone, Debug, Hash, PartialEq, Eq, EncodeLabelSet)]
+struct ErrorLabels {
+    kind: &'static str,
+    error: &'static str,
+}
+
+// route is the client's route template, never the URL.
+#[derive(Clone, Debug, Hash, PartialEq, Eq, EncodeLabelSet)]
+struct ApiRequestLabels {
+    method: &'static str,
+    route: &'static str,
+    status: u16,
+}
+
+#[derive(Clone, Debug, Hash, PartialEq, Eq, EncodeLabelSet)]
+struct TraceLabel {
+    trace_id: String,
+}
+
+type Duration = HistogramWithExemplars<TraceLabel>;
+
+fn duration_histogram() -> Duration {
+    Duration::new(BUCKETS.into_iter())
+}
+
+#[derive(Clone)]
+pub struct Metrics {
+    reconciliations: Family<KindLabel, Counter>,
+    errors: Family<ErrorLabels, Counter>,
+    duration: Family<KindLabel, Duration, fn() -> Duration>,
+    api_requests: Family<ApiRequestLabels, Counter>,
+    leader: Gauge,
+}
+
+impl Metrics {
+    /// Registers every metric on `registry` under the `kates_operator` prefix.
+    pub fn register(registry: &mut Registry) -> Self {
+        let metrics = Self {
+            reconciliations: Family::default(),
+            errors: Family::default(),
+            duration: Family::new_with_constructor(duration_histogram),
+            api_requests: Family::default(),
+            leader: Gauge::default(),
+        };
+        let registry = registry.sub_registry_with_prefix("kates_operator");
+        registry.register(
+            "reconciliations",
+            "Reconcile passes",
+            metrics.reconciliations.clone(),
+        );
+        registry.register(
+            "reconciliation_errors",
+            "Reconcile passes that failed",
+            metrics.errors.clone(),
+        );
+        registry.register_with_unit(
+            "reconcile_duration",
+            "Time a reconcile pass took",
+            Unit::Seconds,
+            metrics.duration.clone(),
+        );
+        registry.register(
+            "api_requests",
+            "Calls to the Kates API",
+            metrics.api_requests.clone(),
+        );
+        registry.register(
+            "leader",
+            "1 while this pod holds the Lease",
+            metrics.leader.clone(),
+        );
+        metrics
+    }
+
+    pub fn api_request(&self, method: &'static str, route: &'static str, status: u16) {
+        self.api_requests
+            .get_or_create(&ApiRequestLabels {
+                method,
+                route,
+                status,
+            })
+            .inc();
+    }
+
+    pub fn set_leader(&self, leader: bool) {
+        self.leader.set(i64::from(leader));
+    }
+
+    /// Counts a pass; the returned guard records its duration when dropped.
+    #[must_use]
+    pub fn reconcile_started(&self, kind: &'static str, trace_id: TraceId) -> ReconcileTimer {
+        self.reconciliations
+            .get_or_create(&KindLabel { kind })
+            .inc();
+        ReconcileTimer {
+            start: Instant::now(),
+            kind,
+            trace_id,
+            duration: self.duration.clone(),
+        }
+    }
+
+    pub fn reconcile_failed(&self, kind: &'static str, error: &'static str) {
+        self.errors
+            .get_or_create(&ErrorLabels { kind, error })
+            .inc();
+    }
+}
+
+pub struct ReconcileTimer {
+    start: Instant,
+    kind: &'static str,
+    trace_id: TraceId,
+    duration: Family<KindLabel, Duration, fn() -> Duration>,
+}
+
+impl Drop for ReconcileTimer {
+    fn drop(&mut self) {
+        let exemplar = (self.trace_id != TraceId::INVALID).then(|| TraceLabel {
+            trace_id: self.trace_id.to_string(),
+        });
+        self.duration
+            .get_or_create(&KindLabel { kind: self.kind })
+            .observe(
+                self.start.elapsed().as_secs_f64(),
+                exemplar,
+                Some(SystemTime::now()),
+            );
+    }
+}
+
+/// The stores behind the gauges, filled once the controllers exist.
+#[derive(Clone, Debug, Default)]
+pub struct Stores {
+    pub tests: Arc<RwLock<Vec<Store<KatesTest>>>>,
+    pub checks: Arc<RwLock<Vec<Store<KafkaCompliance>>>>,
+}
+
+#[derive(Clone, Debug, Hash, PartialEq, Eq, EncodeLabelSet)]
+struct TestLabels {
+    namespace: String,
+    phase: &'static str,
+}
+
+#[derive(Clone, Debug, Hash, PartialEq, Eq, EncodeLabelSet)]
+struct RuleLabels {
+    namespace: String,
+    name: String,
+    verdict: &'static str,
+}
+
+/// Reads the stores at scrape time: a deleted resource's series goes at the next scrape, and a
+/// restart cannot drift the counts.
+#[derive(Debug)]
+pub struct StoreCollector(pub Stores);
+
+impl Collector for StoreCollector {
+    fn encode(&self, mut encoder: DescriptorEncoder) -> Result<(), std::fmt::Error> {
+        let mut tests = std::collections::BTreeMap::new();
+        for store in self.0.tests.read().expect("the stores").iter() {
+            for test in store.state() {
+                let phase = match test.status.as_ref().and_then(|s| s.phase) {
+                    Some(Phase::Running) => "Running",
+                    Some(Phase::Succeeded) => "Succeeded",
+                    Some(Phase::Failed) => "Failed",
+                    Some(Phase::Pending) | None => "Pending",
+                };
+                *tests
+                    .entry((test.namespace().unwrap_or_default(), phase))
+                    .or_insert(0i64) += 1;
+            }
+        }
+        let gauge = ConstGauge::new(0i64);
+        let mut family = encoder.encode_descriptor(
+            "kates_operator_tests",
+            "KatesTests by phase",
+            None,
+            gauge.metric_type(),
+        )?;
+        for ((namespace, phase), count) in tests {
+            let labels = TestLabels { namespace, phase };
+            ConstGauge::new(count).encode(family.encode_family(&labels)?)?;
+        }
+
+        let mut family = encoder.encode_descriptor(
+            "kates_operator_compliance_rules",
+            "Rules of the last compliance check, by verdict",
+            None,
+            gauge.metric_type(),
+        )?;
+        for store in self.0.checks.read().expect("the stores").iter() {
+            for check in store.state() {
+                let Some(counts) = check.status.as_ref().and_then(|s| s.counts.as_ref()) else {
+                    continue;
+                };
+                for (verdict, count) in [
+                    ("pass", counts.pass),
+                    ("fail", counts.fail),
+                    ("unknown", counts.unknown),
+                ] {
+                    let labels = RuleLabels {
+                        namespace: check.namespace().unwrap_or_default(),
+                        name: check.name_any(),
+                        verdict,
+                    };
+                    ConstGauge::new(count).encode(family.encode_family(&labels)?)?;
+                }
+            }
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use opentelemetry::trace::TraceId;
+    use prometheus_client::encoding::text::encode;
+    use prometheus_client::registry::Registry;
+
+    use super::Metrics;
+
+    fn scrape(registry: &Registry) -> String {
+        let mut out = String::new();
+        encode(&mut out, registry).unwrap();
+        out
+    }
+
+    #[test]
+    fn names_and_labels_are_the_ones_dashboards_read() {
+        let mut registry = Registry::default();
+        let metrics = Metrics::register(&mut registry);
+
+        drop(metrics.reconcile_started("KatesTest", TraceId::INVALID));
+        metrics.reconcile_failed("KatesTest", "Rejected");
+
+        let out = scrape(&registry);
+        assert!(out.contains(r#"kates_operator_reconciliations_total{kind="KatesTest"} 1"#));
+        assert!(out.contains(
+            r#"kates_operator_reconciliation_errors_total{kind="KatesTest",error="Rejected"} 1"#
+        ));
+        assert!(
+            out.contains(r#"kates_operator_reconcile_duration_seconds_count{kind="KatesTest"} 1"#)
+        );
+        assert!(out.contains(r#"le="60.0""#));
+        assert!(!out.contains("trace_id"));
+    }
+
+    #[test]
+    fn a_traced_pass_leaves_an_exemplar() {
+        let mut registry = Registry::default();
+        let metrics = Metrics::register(&mut registry);
+
+        drop(metrics.reconcile_started("KatesTest", TraceId::from(7)));
+
+        assert!(scrape(&registry).contains(r#"trace_id="00000000000000000000000000000007""#));
+    }
+}
diff --git a/operator/crates/kates-operator/src/reconcile/compliance.rs b/operator/crates/kates-operator/src/reconcile/compliance.rs
new file mode 100644
index 00000000..c8eb15d8
--- /dev/null
+++ b/operator/crates/kates-operator/src/reconcile/compliance.rs
@@ -0,0 +1,621 @@
+//! `KafkaCompliance`: a standing check. Section 4.4 of plans/operator.md. A watch only enqueues and
+//! a pass cannot see why it ran, so whether to post is decided from state, in [`due`].
+
+use std::sync::Arc;
+use std::time::Duration;
+
+use jiff::{SignedDuration, Timestamp};
+use k8s_openapi::apimachinery::pkg::apis::meta::v1::Time;
+use kates_client::{ComplianceAnswer, Error as ApiError};
+use kates_crds::{ComplianceCounts, FailedRule, KafkaCompliance, KafkaComplianceStatus};
+use kube::ResourceExt as _;
+use kube::api::{Api, DynamicObject, Patch, PatchParams};
+use kube::runtime::controller::Action;
+use serde_json::{Value, json};
+
+use super::{Error, RECONCILE_AT, paused};
+use crate::connection::Failure;
+use crate::context::{Context, Note, Watched};
+use crate::status;
+use crate::telemetry::current_trace_id;
+
+const KIND: &str = "KafkaCompliance";
+const NO_CONNECTION_RETRY: Duration = Duration::from_mins(1);
+const WRITE_RETRY: Duration = Duration::from_secs(30);
+const MIN_INTERVAL: Duration = Duration::from_mins(1);
+const MAX_INTERVAL: Duration = Duration::from_hours(24 * 365);
+const MAX_FAILED: usize = 20;
+
+/// # Errors
+/// A failed Kubernetes write.
+#[tracing::instrument(skip_all, fields(name = %check.name_any(), namespace = ?check.namespace()))]
+pub async fn reconcile(check: Arc<KafkaCompliance>, ctx: Arc<Context>) -> Result<Action, Error> {
+    let _timer = ctx.metrics.reconcile_started(KIND, current_trace_id());
+    let namespace = check.namespace().ok_or(Error::NoNamespace)?;
+    let api: Api<KafkaCompliance> = Api::namespaced(ctx.client.clone(), &namespace);
+    let name = check.name_any();
+    let now = Timestamp::now();
+    let mut pass = Pass::new(&check, now);
+
+    if paused(check.annotations()) {
+        pass.condition(
+            "Reconciling",
+            "False",
+            "Paused",
+            "kates.io/pause-reconciliation is set",
+        );
+        write(&api, &name, &pass.status, &ctx).await?;
+        return Ok(Action::await_change());
+    }
+    if check.spec.suspend {
+        pass.status.observed_generation = check.metadata.generation;
+        pass.condition("Reconciling", "False", "Suspended", "spec.suspend is set");
+        write(&api, &name, &pass.status, &ctx).await?;
+        return Ok(Action::await_change());
+    }
+
+    let (target_namespace, target_name) = target(&check);
+    let watched = pass.kafka_watched(&ctx, &target_namespace);
+    let kafka = if watched == Some(Watched::Yes) {
+        read_kafka(&ctx, &target_namespace, &target_name).await
+    } else {
+        None
+    };
+    if !due(&check, &pass.status, now, kafka) {
+        let wait = wait_until(pass.status.next_check_at.as_ref(), now);
+        write(&api, &name, &pass.status, &ctx).await?;
+        ctx.publish(&*check, pass.notes).await;
+        return Ok(wait);
+    }
+
+    let action = match ctx.connections.resolve(&ctx.client, &namespace).await {
+        Ok(connection) => {
+            let document = reference_document(&name, &check.spec.reference);
+            let answer = connection
+                .api
+                .check_compliance(&connection.key, &document)
+                .await;
+            pass.answered(&check, answer, kafka, &ctx)
+        }
+        Err(Failure::Missing) => {
+            pass.unsynced("NoConnection", &Failure::Missing.to_string());
+            Action::requeue(NO_CONNECTION_RETRY)
+        }
+        Err(Failure::Invalid(message)) => {
+            pass.unsynced("InvalidConnection", &message);
+            Action::requeue(NO_CONNECTION_RETRY)
+        }
+        Err(Failure::Kube(error)) => return Err(error.into()),
+    };
+    write(&api, &name, &pass.status, &ctx).await?;
+    ctx.publish(&*check, pass.notes).await;
+    Ok(action)
+}
+
+#[must_use]
+#[allow(clippy::needless_pass_by_value)] // Controller::run's signature
+pub fn error_policy(check: Arc<KafkaCompliance>, error: &Error, ctx: Arc<Context>) -> Action {
+    ctx.metrics.reconcile_failed(KIND, error.name());
+    tracing::warn!(%error, name = %check.name_any(), "reconcile failed");
+    Action::requeue(WRITE_RETRY)
+}
+
+/// The `Kafka` a check names; the CRD requires both.
+#[must_use]
+pub fn target(check: &KafkaCompliance) -> (String, String) {
+    let field = |key: &str| {
+        check.spec.reference["target"][key]
+            .as_str()
+            .unwrap_or_default()
+            .to_owned()
+    };
+    (field("namespace"), field("name"))
+}
+
+// (generation, status.observedGeneration); a failed or 404 get is no trigger.
+async fn read_kafka(ctx: &Context, namespace: &str, name: &str) -> Option<(i64, i64)> {
+    let watch = ctx.kafka.as_ref()?;
+    let api: Api<DynamicObject> =
+        Api::namespaced_with(ctx.client.clone(), namespace, &watch.resource);
+    let kafka = api.get(name).await.ok()?;
+    Some((
+        kafka.metadata.generation?,
+        kafka.data["status"]["observedGeneration"].as_i64()?,
+    ))
+}
+
+/// The document `POST /api/conformity/check` reads: the resource's name becomes the stored name.
+#[must_use]
+pub fn reference_document(name: &str, reference: &Value) -> Value {
+    json!({
+        "apiVersion": "conformity.kates.io/v1alpha1",
+        "kind": "KafkaReference",
+        "metadata": {"name": name},
+        "spec": reference,
+    })
+}
+
+/// Whether this pass posts. A `Kafka` still rolling (`observedGeneration` behind) is no trigger:
+/// the report would grade a half-rolled cluster. The interval still fires, so a stuck Kafka keeps
+/// being checked.
+#[must_use]
+fn due(
+    check: &KafkaCompliance,
+    status: &KafkaComplianceStatus,
+    now: Timestamp,
+    kafka: Option<(i64, i64)>,
+) -> bool {
+    let changed = check.metadata.generation != status.observed_generation;
+    let forced = check
+        .annotations()
+        .get(RECONCILE_AT)
+        .is_some_and(|value| status.last_handled_reconcile_at.as_ref() != Some(value));
+    let elapsed = status.next_check_at.as_ref().is_some_and(|at| now >= at.0);
+    let stalled = status::is_true(&status.conditions, "Stalled");
+    let kafka_moved = !stalled
+        && kafka.is_some_and(|(generation, observed)| {
+            observed == generation && status.observed_kafka_generation != Some(observed)
+        });
+    changed || forced || elapsed || kafka_moved
+}
+
+fn wait_until(next: Option<&Time>, now: Timestamp) -> Action {
+    next.map_or(Action::await_change(), |at| {
+        let left = at.0.duration_since(now);
+        Action::requeue(Duration::try_from(left).unwrap_or(Duration::ZERO))
+    })
+}
+
+/// `1h`, `30m`, `1h30m`: the shape the CRD's pattern allows, floored so a `0s` cannot spin, and
+/// capped because the pattern allows any number of digits and a timestamp does not.
+#[must_use]
+pub fn interval(text: &str) -> Duration {
+    let mut seconds = 0u64;
+    let mut number = 0u64;
+    for c in text.chars() {
+        if let Some(digit) = c.to_digit(10) {
+            number = number.saturating_mul(10).saturating_add(u64::from(digit));
+            continue;
+        }
+        let unit = match c {
+            'h' => 3600,
+            'm' => 60,
+            _ => 1,
+        };
+        seconds = seconds.saturating_add(number.saturating_mul(unit));
+        number = 0;
+    }
+    Duration::from_secs(seconds).clamp(MIN_INTERVAL, MAX_INTERVAL)
+}
+
+async fn write(
+    api: &Api<KafkaCompliance>,
+    name: &str,
+    status: &KafkaComplianceStatus,
+    ctx: &Context,
+) -> Result<(), Error> {
+    let patch = json!({
+        "apiVersion": "kates.io/v1alpha1",
+        "kind": KIND,
+        "status": status,
+    });
+    let params = PatchParams::apply(&ctx.field_manager).force();
+    api.patch_status(name, &params, &Patch::Apply(patch))
+        .await?;
+    Ok(())
+}
+
+struct Pass {
+    status: KafkaComplianceStatus,
+    generation: Option<i64>,
+    now: Timestamp,
+    notes: Vec<Note>,
+}
+
+impl Pass {
+    fn new(check: &KafkaCompliance, now: Timestamp) -> Self {
+        Self {
+            status: check.status.clone().unwrap_or_default(),
+            generation: check.metadata.generation,
+            now,
+            notes: Vec::new(),
+        }
+    }
+
+    fn condition(&mut self, type_: &str, value: &str, reason: &str, message: &str) {
+        let conditions = &mut self.status.conditions;
+        status::set(
+            conditions,
+            type_,
+            value,
+            reason,
+            message,
+            self.generation,
+            self.now,
+        );
+    }
+
+    fn reason(&self, type_: &str) -> Option<&str> {
+        status::find(&self.status.conditions, type_).map(|c| c.reason.as_str())
+    }
+
+    fn after(&self, wait: Duration) -> Time {
+        let wait = SignedDuration::try_from(wait).expect("an interval fits");
+        Time(self.now.saturating_add(wait).expect("an interval fits"))
+    }
+
+    fn kafka_watched(&mut self, ctx: &Context, namespace: &str) -> Option<Watched> {
+        let Some(watch) = &ctx.kafka else {
+            self.condition(
+                "KafkaWatched",
+                "False",
+                "NoStrimzi",
+                "no Strimzi CRD: interval only",
+            );
+            return None;
+        };
+        let state = watch.watched(namespace);
+        let (value, reason, message) = match state {
+            Watched::Yes => ("True", "Watching", String::new()),
+            Watched::NotConfigured => (
+                "False",
+                "NamespaceNotConfigured",
+                format!("add {namespace} to kafka.namespaces; until then, interval only"),
+            ),
+            Watched::Forbidden => (
+                "False",
+                "Forbidden",
+                format!(
+                    "the operator may not list kafkas in {namespace}: bind its kafka-reader Role"
+                ),
+            ),
+        };
+        if value == "False" && self.reason("KafkaWatched") != Some(reason) {
+            self.notes.push(Note {
+                warning: true,
+                reason: "KafkaNotWatched",
+                message: message.clone(),
+            });
+        }
+        self.condition("KafkaWatched", value, reason, &message);
+        Some(state)
+    }
+
+    fn unsynced(&mut self, reason: &'static str, message: &str) {
+        if self.reason("Synced") != Some(reason) {
+            self.notes.push(Note {
+                warning: true,
+                reason,
+                message: message.to_owned(),
+            });
+        }
+        self.condition("Synced", "False", reason, message);
+    }
+
+    fn record(&mut self, check: &KafkaCompliance, kafka: Option<(i64, i64)>) {
+        self.status.observed_generation = check.metadata.generation;
+        if let Some(value) = check.annotations().get(RECONCILE_AT) {
+            self.status.last_handled_reconcile_at = Some(value.clone());
+        }
+        if let Some((_, observed)) = kafka {
+            self.status.observed_kafka_generation = Some(observed);
+        }
+    }
+
+    fn answered(
+        &mut self,
+        check: &KafkaCompliance,
+        answer: Result<ComplianceAnswer, ApiError>,
+        kafka: Option<(i64, i64)>,
+        ctx: &Context,
+    ) -> Action {
+        let every = interval(&check.spec.interval);
+        match answer {
+            Ok(answer) => {
+                self.record(check, kafka);
+                self.verdict(answer, every, kafka)
+            }
+            // The reference is wrong as written: no POST until the spec or reconcile-at changes.
+            Err(ApiError::Rejected { message, .. }) => {
+                self.record(check, kafka);
+                self.status.next_check_at = None;
+                self.unsynced("SpecRejected", &message);
+                self.condition("Ready", "False", "SpecRejected", &message);
+                self.condition("Stalled", "True", "SpecRejected", &message);
+                Action::await_change()
+            }
+            // A refused check waits for the interval, not the next pass.
+            Err(
+                ApiError::Conflict { message }
+                | ApiError::Unavailable {
+                    status: Some(503),
+                    api_message: Some(message),
+                    ..
+                },
+            ) => self.refused(check, kafka, every, &message),
+            Err(error) => {
+                ctx.metrics.reconcile_failed(KIND, error.name());
+                let reason = match error {
+                    ApiError::InvalidKey => "InvalidKey",
+                    ApiError::MissingScope => "MissingScope",
+                    _ => "ApiUnavailable",
+                };
+                self.unsynced(reason, &error.to_string());
+                Action::requeue(status::backoff(&self.status.conditions, self.now))
+            }
+        }
+    }
+
+    fn refused(
+        &mut self,
+        check: &KafkaCompliance,
+        kafka: Option<(i64, i64)>,
+        every: Duration,
+        message: &str,
+    ) -> Action {
+        self.record(check, kafka);
+        self.status.next_check_at = Some(self.after(every));
+        self.unsynced("CheckRefused", message);
+        Action::requeue(every)
+    }
+
+    fn verdict(
+        &mut self,
+        answer: ComplianceAnswer,
+        every: Duration,
+        kafka: Option<(i64, i64)>,
+    ) -> Action {
+        let report = answer.report;
+        let previous = self.status.verdict.replace(report.verdict.clone());
+        let failed: Vec<FailedRule> = report
+            .results
+            .iter()
+            .filter(|result| result.status == "FAIL")
+            .take(MAX_FAILED)
+            .map(|result| FailedRule {
+                rule: result.rule.clone(),
+                detail: result.detail.clone(),
+            })
+            .collect();
+        let first = failed
+            .first()
+            .map_or(String::new(), |rule| match &rule.detail {
+                Some(detail) => format!("{}: {detail}", rule.rule),
+                None => rule.rule.clone(),
+            });
+        match (previous.as_deref(), report.verdict.as_str()) {
+            (Some("FAIL"), "FAIL") => {}
+            (_, "FAIL") => self.notes.push(Note {
+                warning: true,
+                reason: "ComplianceFailed",
+                message: first.clone(),
+            }),
+            (Some("FAIL"), "PASS") => self.notes.push(Note {
+                warning: false,
+                reason: "ComplianceRestored",
+                message: "every rule passes".to_owned(),
+            }),
+            _ => {}
+        }
+        self.status.counts = Some(ComplianceCounts {
+            pass: report.summary.pass,
+            fail: report.summary.fail,
+            unknown: report.summary.unknown,
+        });
+        self.status.failed = failed;
+        self.status.checked_at = Some(Time(self.now));
+        self.status.check_id.clone_from(&answer.check_id);
+        status::remove(&mut self.status.conditions, "Stalled");
+
+        let lagging = kafka.is_some_and(|(generation, observed)| generation != observed);
+        let message = if lagging {
+            format!("Kafka not yet reconciled. {first}")
+                .trim()
+                .to_owned()
+        } else {
+            first
+        };
+        let compliant = match report.verdict.as_str() {
+            "PASS" => "True",
+            "FAIL" => "False",
+            _ => "Unknown",
+        };
+        self.condition("Compliant", compliant, &report.verdict, &message);
+        self.condition("Ready", "True", "Checked", "");
+        self.condition("Reconciling", "False", "Checked", "");
+
+        // The usual cause of a lost report is the Kates database, so it retries on the backoff.
+        if answer.check_id.is_none() {
+            self.unsynced(
+                "ReportNotStored",
+                "the API ran the check but kept no report",
+            );
+            let wait = status::backoff(&self.status.conditions, self.now);
+            self.status.next_check_at = Some(self.after(wait));
+            return Action::requeue(wait);
+        }
+        self.condition("Synced", "True", "Checked", "");
+        self.status.next_check_at = Some(self.after(every));
+        Action::requeue(every)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use kates_client::{ComplianceReport, ComplianceResult, ComplianceSummary};
+    use kates_crds::KafkaComplianceSpec;
+
+    use super::*;
+
+    fn at(seconds: i64) -> Timestamp {
+        Timestamp::from_second(seconds).unwrap()
+    }
+
+    fn check() -> KafkaCompliance {
+        let spec: KafkaComplianceSpec = serde_json::from_value(json!({
+            "reference": {"target": {"namespace": "kafka", "name": "krafter"}},
+            "interval": "1h",
+        }))
+        .unwrap();
+        let mut check = KafkaCompliance::new("rules", spec);
+        check.metadata.generation = Some(1);
+        check
+    }
+
+    fn checked() -> KafkaComplianceStatus {
+        KafkaComplianceStatus {
+            observed_generation: Some(1),
+            next_check_at: Some(Time(at(1000))),
+            observed_kafka_generation: Some(7),
+            ..KafkaComplianceStatus::default()
+        }
+    }
+
+    fn answer(verdict: &str, check_id: Option<&str>) -> ComplianceAnswer {
+        ComplianceAnswer {
+            report: ComplianceReport {
+                verdict: verdict.to_owned(),
+                summary: ComplianceSummary {
+                    pass: 3,
+                    fail: i64::from(verdict == "FAIL"),
+                    ..ComplianceSummary::default()
+                },
+                results: vec![ComplianceResult {
+                    rule: "kafka.replicas.min".to_owned(),
+                    status: verdict.to_owned(),
+                    detail: Some("2 < 3".to_owned()),
+                }],
+            },
+            check_id: check_id.map(str::to_owned),
+        }
+    }
+
+    fn pass() -> Pass {
+        Pass::new(&check(), at(100))
+    }
+
+    fn reasons(pass: &Pass) -> Vec<&'static str> {
+        pass.notes.iter().map(|note| note.reason).collect()
+    }
+
+    #[test]
+    fn the_document_wraps_the_reference() {
+        assert_eq!(
+            reference_document("rules", &json!({"target": {"name": "k"}})),
+            json!({"apiVersion": "conformity.kates.io/v1alpha1", "kind": "KafkaReference",
+                "metadata": {"name": "rules"}, "spec": {"target": {"name": "k"}}})
+        );
+    }
+
+    #[test]
+    fn intervals_parse_and_are_floored() {
+        assert_eq!(interval("1h"), Duration::from_hours(1));
+        assert_eq!(interval("1h30m"), Duration::from_mins(90));
+        assert_eq!(interval("90s"), Duration::from_secs(90));
+        assert_eq!(interval("0s"), MIN_INTERVAL);
+        assert_eq!(interval("99999999999999999999999h"), MAX_INTERVAL);
+    }
+
+    #[test]
+    fn a_new_resource_a_new_generation_or_a_forced_pass_posts() {
+        assert!(due(
+            &check(),
+            &KafkaComplianceStatus::default(),
+            at(100),
+            None
+        ));
+
+        let mut edited = check();
+        edited.metadata.generation = Some(2);
+        assert!(due(&edited, &checked(), at(100), None));
+
+        let mut forced = check();
+        forced
+            .annotations_mut()
+            .insert(RECONCILE_AT.to_owned(), "now".to_owned());
+        assert!(due(&forced, &checked(), at(100), None));
+        let handled = KafkaComplianceStatus {
+            last_handled_reconcile_at: Some("now".to_owned()),
+            ..checked()
+        };
+        assert!(!due(&forced, &handled, at(100), None));
+    }
+
+    #[test]
+    fn nothing_new_waits_for_the_interval() {
+        assert!(!due(&check(), &checked(), at(100), Some((7, 7))));
+        assert!(due(&check(), &checked(), at(1000), None));
+    }
+
+    #[test]
+    fn a_kafka_triggers_only_once_it_has_settled() {
+        assert!(due(&check(), &checked(), at(100), Some((8, 8))));
+        assert!(!due(&check(), &checked(), at(100), Some((8, 7))));
+    }
+
+    #[test]
+    fn a_rejected_reference_stops_the_kafka_trigger() {
+        let mut status = checked();
+        status::set(
+            &mut status.conditions,
+            "Stalled",
+            "True",
+            "SpecRejected",
+            "",
+            None,
+            at(1),
+        );
+        status.next_check_at = None;
+        assert!(!due(&check(), &status, at(100), Some((8, 8))));
+    }
+
+    #[test]
+    fn a_failure_tells_once_and_a_recovery_tells_once() {
+        let mut pass = pass();
+        pass.verdict(answer("FAIL", Some("c1")), MIN_INTERVAL, None);
+        pass.verdict(answer("FAIL", Some("c2")), MIN_INTERVAL, None);
+        assert_eq!(reasons(&pass), ["ComplianceFailed"]);
+        pass.verdict(answer("PASS", Some("c3")), MIN_INTERVAL, None);
+        assert_eq!(reasons(&pass), ["ComplianceFailed", "ComplianceRestored"]);
+        assert_eq!(pass.reason("Compliant"), Some("PASS"));
+        assert_eq!(pass.status.check_id.as_deref(), Some("c3"));
+        assert_eq!(pass.status.failed, []);
+    }
+
+    #[test]
+    fn the_verdict_fills_the_status() {
+        let mut pass = pass();
+        let action = pass.verdict(answer("FAIL", Some("c1")), Duration::from_hours(1), None);
+        assert_eq!(action, Action::requeue(Duration::from_hours(1)));
+        assert_eq!(pass.status.counts.as_ref().unwrap().fail, 1);
+        assert_eq!(pass.status.failed[0].rule, "kafka.replicas.min");
+        assert_eq!(pass.status.next_check_at.as_ref().unwrap().0, at(3700));
+        let compliant = status::find(&pass.status.conditions, "Compliant").unwrap();
+        assert_eq!(compliant.status, "False");
+        assert_eq!(compliant.message, "kafka.replicas.min: 2 < 3");
+    }
+
+    #[test]
+    fn a_lost_report_clears_the_old_id_and_retries_soon() {
+        let mut pass = pass();
+        pass.status.check_id = Some("old".to_owned());
+        let action = pass.verdict(answer("PASS", None), Duration::from_hours(1), None);
+        assert_eq!(pass.status.check_id, None);
+        assert_eq!(pass.reason("Synced"), Some("ReportNotStored"));
+        assert_eq!(reasons(&pass), ["ReportNotStored"]);
+        assert_eq!(action, Action::requeue(Duration::from_secs(5)));
+    }
+
+    #[test]
+    fn a_lagging_kafka_is_said_in_the_message() {
+        let mut pass = pass();
+        pass.verdict(answer("PASS", Some("c1")), MIN_INTERVAL, Some((8, 7)));
+        let compliant = status::find(&pass.status.conditions, "Compliant").unwrap();
+        assert_eq!(compliant.message, "Kafka not yet reconciled.");
+    }
+
+    #[test]
+    fn the_target_comes_from_the_reference() {
+        assert_eq!(target(&check()), ("kafka".to_owned(), "krafter".to_owned()));
+    }
+}
diff --git a/operator/crates/kates-operator/src/reconcile/mod.rs b/operator/crates/kates-operator/src/reconcile/mod.rs
new file mode 100644
index 00000000..59dac1e9
--- /dev/null
+++ b/operator/crates/kates-operator/src/reconcile/mod.rs
@@ -0,0 +1,56 @@
+//! The reconcilers, one per kind.
+
+pub mod compliance;
+pub mod test;
+
+use std::collections::BTreeMap;
+
+pub const PAUSE: &str = "kates.io/pause-reconciliation";
+pub const RECONCILE_AT: &str = "kates.io/reconcile-at";
+
+#[must_use]
+pub fn paused(annotations: &BTreeMap<String, String>) -> bool {
+    annotations.get(PAUSE).is_some_and(|value| value == "true")
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("a namespaced resource without a namespace")]
+    NoNamespace,
+    #[error(transparent)]
+    Kube(#[from] kube::Error),
+    #[error("the run could not be cancelled: {0}")]
+    Cancel(#[source] kates_client::Error),
+    #[error(transparent)]
+    Finalizer(#[from] Box<kube::runtime::finalizer::Error<Error>>),
+}
+
+impl Error {
+    /// A bounded metric label.
+    #[must_use]
+    pub fn name(&self) -> &'static str {
+        match self {
+            Self::NoNamespace => "NoNamespace",
+            Self::Kube(_) => "Kube",
+            Self::Cancel(error) => error.name(),
+            Self::Finalizer(error) => match &**error {
+                kube::runtime::finalizer::Error::ApplyFailed(inner)
+                | kube::runtime::finalizer::Error::CleanupFailed(inner) => inner.name(),
+                _ => "Finalizer",
+            },
+        }
+    }
+
+    /// A failed cancel takes the Kates API's backoff; anything else is a Kubernetes API write.
+    #[must_use]
+    pub fn is_cancel(&self) -> bool {
+        match self {
+            Self::Cancel(_) => true,
+            Self::Finalizer(error) => matches!(
+                &**error,
+                kube::runtime::finalizer::Error::CleanupFailed(Self::Cancel(_))
+            ),
+            _ => false,
+        }
+    }
+}
diff --git a/operator/crates/kates-operator/src/reconcile/test.rs b/operator/crates/kates-operator/src/reconcile/test.rs
new file mode 100644
index 00000000..7394b7e3
--- /dev/null
+++ b/operator/crates/kates-operator/src/reconcile/test.rs
@@ -0,0 +1,732 @@
+//! `KatesTest`: one run. Section 4.2 of plans/operator.md, step by step. The decisions are in
+//! [`Pass`], over the status alone, so each is testable without a cluster.
+
+use std::sync::Arc;
+use std::time::Duration;
+
+use jiff::{SignedDuration, Timestamp};
+use k8s_openapi::apimachinery::pkg::apis::meta::v1::Time;
+use kates_client::{Error as ApiError, Report, Run, RunStatus};
+use kates_crds::{KatesTest, KatesTestStatus, Phase, RunSummary};
+use kube::api::{DeleteParams, Patch, PatchParams};
+use kube::runtime::controller::Action;
+use kube::runtime::finalizer::{self, Event as Finalizer};
+use kube::{Api, Resource as _, ResourceExt as _};
+use serde_json::{Value, json};
+
+use super::{Error, RECONCILE_AT, paused};
+use crate::connection::{Connection, Failure};
+use crate::context::{Context, Note};
+use crate::status;
+use crate::telemetry::current_trace_id;
+
+pub const FINALIZER: &str = "kates.io/finalizer";
+const KIND: &str = "KatesTest";
+const CLIENT_KEY: &str = "clientKey";
+const MINIMUM_VERSION: &str = "1.38.0";
+const POLL: Duration = Duration::from_secs(10);
+const NO_CONNECTION_RETRY: Duration = Duration::from_mins(1);
+const API_TOO_OLD_RETRY: Duration = Duration::from_mins(5);
+const ENGINE_FULL_RETRY: Duration = Duration::from_secs(30);
+const WRITE_RETRY: Duration = Duration::from_secs(30);
+
+/// # Errors
+/// A failed Kubernetes write, or a cancel that must hold the finalizer.
+#[tracing::instrument(skip_all, fields(name = %test.name_any(), namespace = ?test.namespace()))]
+pub async fn reconcile(test: Arc<KatesTest>, ctx: Arc<Context>) -> Result<Action, Error> {
+    let _timer = ctx.metrics.reconcile_started(KIND, current_trace_id());
+    let namespace = test.namespace().ok_or(Error::NoNamespace)?;
+    let api: Api<KatesTest> = Api::namespaced(ctx.client.clone(), &namespace);
+
+    // A settled resource never enters finalizer(), which re-adds its entry on every pass.
+    if settled(&test) {
+        return finish_settled(&test, &api, &ctx).await;
+    }
+    finalizer::finalizer(&api, FINALIZER, test, |event| async {
+        match event {
+            Finalizer::Apply(test) => apply(&test, &api, &ctx).await,
+            Finalizer::Cleanup(test) => cleanup(&test, &namespace, &api, &ctx).await,
+        }
+    })
+    .await
+    .map_err(|error| Error::Finalizer(Box::new(error)))
+}
+
+#[must_use]
+#[allow(clippy::needless_pass_by_value)] // Controller::run's signature
+pub fn error_policy(test: Arc<KatesTest>, error: &Error, ctx: Arc<Context>) -> Action {
+    ctx.metrics.reconcile_failed(KIND, error.name());
+    tracing::warn!(%error, name = %test.name_any(), "reconcile failed");
+    if error.is_cancel() {
+        let conditions = test.status.as_ref().map_or(&[][..], |s| &s.conditions);
+        return Action::requeue(status::backoff(conditions, Timestamp::now()));
+    }
+    Action::requeue(WRITE_RETRY)
+}
+
+fn settled(test: &KatesTest) -> bool {
+    test.status.as_ref().is_some_and(|status| {
+        status.finished_at.is_some() && status.observed_generation == test.metadata.generation
+    })
+}
+
+async fn finish_settled(
+    test: &KatesTest,
+    api: &Api<KatesTest>,
+    ctx: &Context,
+) -> Result<Action, Error> {
+    let name = test.name_any();
+    let deleting = test.meta().deletion_timestamp.is_some();
+    let mut pass = Pass::new(test, Timestamp::now());
+    if paused(test.annotations()) && !deleting {
+        pass.paused();
+        write(api, &name, &pass.status, ctx).await?;
+        return Ok(Action::await_change());
+    }
+    pass.handle_reconcile_at(test);
+    pass.condition("Reconciling", "False", "Finished", "");
+    // Status first, then the strip, so a crash between the two heals on the next pass.
+    write(api, &name, &pass.status, ctx).await?;
+    strip_finalizer(test, api).await?;
+    if deleting {
+        return Ok(Action::await_change());
+    }
+    match ttl_left(test, pass.now) {
+        None => Ok(Action::await_change()),
+        Some(left) if left.is_zero() => {
+            api.delete(&name, &DeleteParams::default()).await?;
+            Ok(Action::await_change())
+        }
+        Some(left) => Ok(Action::requeue(left)),
+    }
+}
+
+// The remaining time, never the whole TTL, or every restart would reset the clock.
+fn ttl_left(test: &KatesTest, now: Timestamp) -> Option<Duration> {
+    let ttl = i64::from(test.spec.ttl_seconds_after_finished?);
+    let finished = test.status.as_ref()?.finished_at.as_ref()?.0;
+    let left = finished
+        .saturating_add(SignedDuration::from_secs(ttl))
+        .expect("a TTL fits a timestamp")
+        .duration_since(now);
+    Some(Duration::try_from(left).unwrap_or(Duration::ZERO))
+}
+
+// A test-guarded patch, as kube's own helper: a merge patch of the list could drop another
+// controller's entry.
+async fn strip_finalizer(test: &KatesTest, api: &Api<KatesTest>) -> Result<(), Error> {
+    let finalizers = test.finalizers();
+    let Some(index) = finalizers.iter().position(|f| f == FINALIZER) else {
+        return Ok(());
+    };
+    let entry = format!("/metadata/finalizers/{index}");
+    let patch: json_patch::Patch = serde_json::from_value(json!([
+        {"op": "test", "path": entry, "value": FINALIZER},
+        {"op": "remove", "path": entry},
+    ]))
+    .expect("a JSON patch");
+    api.patch(
+        &test.name_any(),
+        &PatchParams::default(),
+        &Patch::Json::<()>(patch),
+    )
+    .await?;
+    Ok(())
+}
+
+async fn apply(test: &KatesTest, api: &Api<KatesTest>, ctx: &Context) -> Result<Action, Error> {
+    let name = test.name_any();
+    let now = Timestamp::now();
+    let mut pass = Pass::new(test, now);
+    if paused(test.annotations()) {
+        pass.paused();
+        write(api, &name, &pass.status, ctx).await?;
+        return Ok(Action::await_change());
+    }
+    pass.handle_reconcile_at(test);
+    pass.reopen_if_edited();
+
+    let namespace = test.namespace().ok_or(Error::NoNamespace)?;
+    let action = match ctx.connections.resolve(&ctx.client, &namespace).await {
+        Ok(connection) => drive(test, &mut pass, &connection, ctx).await,
+        Err(Failure::Missing) => pass.no_connection("NoConnection", &Failure::Missing.to_string()),
+        Err(Failure::Invalid(message)) => pass.no_connection("InvalidConnection", &message),
+        Err(Failure::Kube(error)) => return Err(error.into()),
+    };
+    write(api, &name, &pass.status, ctx).await?;
+    ctx.publish(test, pass.notes).await;
+    Ok(action)
+}
+
+async fn drive(
+    test: &KatesTest,
+    pass: &mut Pass,
+    connection: &Connection,
+    ctx: &Context,
+) -> Action {
+    let uid = test.uid().unwrap_or_default();
+    let (api, key) = (&connection.api, &connection.key);
+    let Some(id) = pass.status.run_id.clone() else {
+        return match api.capabilities(key).await {
+            Ok(capabilities) if capabilities.iter().any(|c| c == CLIENT_KEY) => {
+                let answer = api.create_test(key, &uid, &request(test)).await;
+                pass.created(answer, ctx)
+            }
+            Ok(_) => pass.api_too_old(),
+            Err(error) => pass.failed(&error, ctx),
+        };
+    };
+    match api.get_test(key, &id).await {
+        Err(ApiError::NotFound) => pass.stall(
+            "RunGone",
+            "the Kates run no longer exists: it was deleted, or the database was replaced",
+        ),
+        Err(error) => pass.failed(&error, ctx),
+        Ok(run) if run.client_key.as_deref() != Some(&uid) => pass.stall(
+            "ForeignRun",
+            "this run was not started by this resource, so it is neither followed nor cancelled",
+        ),
+        Ok(run) if !run.status.is_terminal() => pass.live(&run),
+        Ok(run) => match api.report(key, &id).await {
+            Ok(report) => pass.ended(&run, &report),
+            // Never SpecRejected: a missing run answers 400 here, and the next pass finds RunGone.
+            Err(error) => pass.report_failed(&error, ctx),
+        },
+    }
+}
+
+/// The body of `POST /api/tests`.
+#[must_use]
+pub fn request(test: &KatesTest) -> Value {
+    let spec = &test.spec;
+    let mut body = json!({"type": spec.test_type});
+    for (key, value) in [
+        ("spec", spec.spec.as_ref()),
+        ("sla", spec.sla.as_ref()),
+        ("scenario", spec.scenario.as_ref()),
+    ] {
+        if let Some(value) = value {
+            body[key] = value.clone();
+        }
+    }
+    if let Some(backend) = &spec.backend {
+        body["backend"] = backend.as_str().into();
+    }
+    body
+}
+
+async fn cleanup(
+    test: &KatesTest,
+    namespace: &str,
+    api: &Api<KatesTest>,
+    ctx: &Context,
+) -> Result<Action, Error> {
+    let run_id = test.status.as_ref().and_then(|s| s.run_id.clone());
+    let connection = match ctx.connections.resolve(&ctx.client, namespace).await {
+        Ok(connection) => connection,
+        // No key could ever cancel, and holding on would leave the namespace Terminating.
+        // The API ends the run itself through its timeout reaper.
+        Err(Failure::Missing | Failure::Invalid(_)) => {
+            let message = format!(
+                "no connection to cancel run {}: Kates ends it at its own timeout",
+                run_id.as_deref().unwrap_or("(none)")
+            );
+            ctx.publish(test, vec![warning("CancelSkipped", message)])
+                .await;
+            return Ok(Action::await_change());
+        }
+        Err(Failure::Kube(error)) => return Err(error.into()),
+    };
+    match cancel(test, run_id.as_deref(), &connection).await {
+        Ok(Some(id)) => {
+            let note = Note {
+                warning: false,
+                reason: "Cancelled",
+                message: format!("run {id} cancelled"),
+            };
+            ctx.publish(test, vec![note]).await;
+            Ok(Action::await_change())
+        }
+        Ok(None) => Ok(Action::await_change()),
+        Err(error) => {
+            let mut pass = Pass::new(test, Timestamp::now());
+            let hatch = format!(
+                "{error}. The finalizer holds until the API answers; to give up on the run: \
+                 kubectl patch katestest {} --type=merge -p '{{\"metadata\":{{\"finalizers\":null}}}}'",
+                test.name_any()
+            );
+            pass.unsynced(api_reason(&error), &hatch);
+            write(api, &test.name_any(), &pass.status, ctx).await?;
+            ctx.publish(test, pass.notes).await;
+            Err(Error::Cancel(error))
+        }
+    }
+}
+
+// The run this resource started, cancelled when live; its id when it was.
+async fn cancel(
+    test: &KatesTest,
+    run_id: Option<&str>,
+    connection: &Connection,
+) -> Result<Option<String>, ApiError> {
+    let uid = test.uid().unwrap_or_default();
+    let (api, key) = (&connection.api, &connection.key);
+    let run = match run_id {
+        Some(id) => match api.get_test(key, id).await {
+            Ok(run) => Some(run),
+            Err(ApiError::NotFound) => None,
+            Err(error) => return Err(error),
+        },
+        None => api.find_by_client_key(key, &uid).await?,
+    };
+    let Some(run) = run else { return Ok(None) };
+    if run.client_key.as_deref() != Some(&uid) || run.status.is_terminal() {
+        return Ok(None);
+    }
+    match api.cancel_test(key, &run.id).await {
+        Ok(()) => Ok(Some(run.id)),
+        // "Test is not running": it finished in between.
+        Err(ApiError::Conflict { .. } | ApiError::NotFound) => Ok(None),
+        Err(error) => Err(error),
+    }
+}
+
+async fn write(
+    api: &Api<KatesTest>,
+    name: &str,
+    status: &KatesTestStatus,
+    ctx: &Context,
+) -> Result<(), Error> {
+    let patch = json!({
+        "apiVersion": "kates.io/v1alpha1",
+        "kind": KIND,
+        "status": status,
+    });
+    let params = PatchParams::apply(&ctx.field_manager).force();
+    api.patch_status(name, &params, &Patch::Apply(patch))
+        .await?;
+    Ok(())
+}
+
+fn api_reason(error: &ApiError) -> &'static str {
+    match error {
+        ApiError::InvalidKey => "InvalidKey",
+        ApiError::MissingScope => "MissingScope",
+        _ => "ApiUnavailable",
+    }
+}
+
+fn warning(reason: &'static str, message: String) -> Note {
+    Note {
+        warning: true,
+        reason,
+        message,
+    }
+}
+
+/// One pass's status: what the run says, turned into conditions.
+struct Pass {
+    status: KatesTestStatus,
+    generation: Option<i64>,
+    now: Timestamp,
+    notes: Vec<Note>,
+}
+
+impl Pass {
+    fn new(test: &KatesTest, now: Timestamp) -> Self {
+        let mut status = test.status.clone().unwrap_or_default();
+        status.observed_generation = test.metadata.generation;
+        Self {
+            status,
+            generation: test.metadata.generation,
+            now,
+            notes: Vec::new(),
+        }
+    }
+
+    fn condition(&mut self, type_: &str, value: &str, reason: &str, message: &str) {
+        let conditions = &mut self.status.conditions;
+        status::set(
+            conditions,
+            type_,
+            value,
+            reason,
+            message,
+            self.generation,
+            self.now,
+        );
+    }
+
+    fn reason(&self, type_: &str) -> Option<&str> {
+        status::find(&self.status.conditions, type_).map(|c| c.reason.as_str())
+    }
+
+    fn paused(&mut self) {
+        self.condition(
+            "Reconciling",
+            "False",
+            "Paused",
+            "kates.io/pause-reconciliation is set",
+        );
+    }
+
+    fn handle_reconcile_at(&mut self, test: &KatesTest) {
+        if let Some(value) = test.annotations().get(RECONCILE_AT) {
+            self.status.last_handled_reconcile_at = Some(value.clone());
+        }
+    }
+
+    // A rejected resource whose spec was edited: the same key is safe, a 400 stored no run.
+    fn reopen_if_edited(&mut self) {
+        if self.status.finished_at.take().is_some() {
+            self.status.phase = None;
+            status::remove(&mut self.status.conditions, "Stalled");
+        }
+    }
+
+    fn synced(&mut self, reason: &str) {
+        self.condition("Synced", "True", reason, "");
+    }
+
+    /// `Synced=False`, with one Event per transition, never per retry.
+    fn unsynced(&mut self, reason: &'static str, message: &str) {
+        if self.reason("Synced") != Some(reason) {
+            self.notes.push(warning(reason, message.to_owned()));
+        }
+        self.condition("Synced", "False", reason, message);
+        self.condition("Ready", "False", reason, message);
+        self.condition("Reconciling", "True", reason, message);
+    }
+
+    fn backoff(&self) -> Action {
+        Action::requeue(status::backoff(&self.status.conditions, self.now))
+    }
+
+    fn no_connection(&mut self, reason: &'static str, message: &str) -> Action {
+        self.unsynced(reason, message);
+        Action::requeue(NO_CONNECTION_RETRY)
+    }
+
+    fn api_too_old(&mut self) -> Action {
+        self.status.phase = Some(Phase::Pending);
+        let message = format!(
+            "this Kates API cannot honour an idempotency key, so no run is started: \
+             it needs Kates {MINIMUM_VERSION} or newer"
+        );
+        self.unsynced("ApiTooOld", &message);
+        Action::requeue(API_TOO_OLD_RETRY)
+    }
+
+    fn failed(&mut self, error: &ApiError, ctx: &Context) -> Action {
+        ctx.metrics.reconcile_failed(KIND, error.name());
+        self.unsynced(api_reason(error), &error.to_string());
+        self.backoff()
+    }
+
+    fn report_failed(&mut self, error: &ApiError, ctx: &Context) -> Action {
+        ctx.metrics.reconcile_failed(KIND, error.name());
+        let reason = api_reason(error);
+        self.unsynced(
+            reason,
+            &format!("the run ended but its report is not readable: {error}"),
+        );
+        self.backoff()
+    }
+
+    fn created(&mut self, answer: Result<Run, ApiError>, ctx: &Context) -> Action {
+        match answer {
+            Ok(run) => {
+                self.notes.push(Note {
+                    warning: false,
+                    reason: "RunCreated",
+                    message: format!("run {}", run.id),
+                });
+                self.status.run_id = Some(run.id.clone());
+                self.status.started_at = Some(Time(self.now));
+                self.synced("RunCreated");
+                self.live(&run)
+            }
+            Err(ApiError::Rejected { message, .. }) => self.stall("SpecRejected", &message),
+            Err(ApiError::RateLimited {
+                retry_after,
+                message,
+            }) => {
+                self.status.phase = Some(Phase::Pending);
+                self.unsynced("EngineFull", &message);
+                Action::requeue(retry_after.unwrap_or(ENGINE_FULL_RETRY))
+            }
+            Err(error) => self.failed(&error, ctx),
+        }
+    }
+
+    fn live(&mut self, run: &Run) -> Action {
+        self.status.phase = Some(if run.status == RunStatus::Pending {
+            Phase::Pending
+        } else {
+            Phase::Running
+        });
+        if self.reason("Synced") != Some("RunCreated") {
+            self.synced("Following");
+        }
+        self.condition("Ready", "False", "Running", "");
+        self.condition("Reconciling", "True", "Running", "");
+        self.condition("SlaPassed", "Unknown", "Running", "");
+        Action::requeue(POLL)
+    }
+
+    /// A terminal run, whose report answered: every field in one patch.
+    fn ended(&mut self, run: &Run, report: &Report) -> Action {
+        self.status.summary = serde_json::from_value::<RunSummary>(report.summary.clone()).ok();
+        let verdict = report.overall_sla_verdict.as_ref();
+        let passed = verdict.is_none_or(|v| v.passed);
+        let first = verdict
+            .and_then(|v| v.violations.first())
+            .map(ToString::to_string);
+        self.synced("Finished");
+        self.condition(
+            "SlaPassed",
+            if passed { "True" } else { "False" },
+            if passed { "SlaPassed" } else { "SlaFailed" },
+            first.as_deref().unwrap_or_default(),
+        );
+        if run.status == RunStatus::Failed {
+            return self.stall("RunFailed", first.as_deref().unwrap_or("the run failed"));
+        }
+        if !passed {
+            return self.stall("SlaFailed", first.as_deref().unwrap_or("the SLA failed"));
+        }
+        self.status.phase = Some(Phase::Succeeded);
+        self.status.finished_at = Some(Time(self.now));
+        self.condition("Ready", "True", "RunCompleted", "");
+        self.condition("Reconciling", "False", "Finished", "");
+        self.notes.push(Note {
+            warning: false,
+            reason: "RunCompleted",
+            message: format!("run {} met its gates", run.id),
+        });
+        Action::requeue(Duration::ZERO)
+    }
+
+    /// Nothing here will progress without a new resource: `Failed`, once.
+    fn stall(&mut self, reason: &'static str, message: &str) -> Action {
+        self.status.phase = Some(Phase::Failed);
+        self.status.finished_at = Some(Time(self.now));
+        if reason != "RunFailed" && reason != "SlaFailed" {
+            self.condition("Synced", "False", reason, message);
+        }
+        self.condition("Ready", "False", reason, message);
+        self.condition("Stalled", "True", reason, message);
+        self.condition("Reconciling", "False", reason, message);
+        self.notes.push(warning(reason, message.to_owned()));
+        Action::requeue(Duration::ZERO)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use kates_client::{SlaVerdict, Violation};
+    use kates_crds::KatesTestSpec;
+
+    use super::*;
+
+    fn resource(body: Value) -> KatesTest {
+        let spec: KatesTestSpec = serde_json::from_value(body).unwrap();
+        let mut test = KatesTest::new("t", spec);
+        test.metadata.generation = Some(1);
+        test
+    }
+
+    fn flat() -> KatesTest {
+        resource(json!({"type": "LOAD", "spec": {"numRecords": 1}}))
+    }
+
+    fn at(seconds: i64) -> Timestamp {
+        Timestamp::from_second(seconds).unwrap()
+    }
+
+    fn pass() -> Pass {
+        Pass::new(&flat(), at(100))
+    }
+
+    fn run(status: RunStatus) -> Run {
+        Run {
+            id: "r1".to_owned(),
+            status,
+            client_key: Some("uid".to_owned()),
+        }
+    }
+
+    fn report(passed: bool, violation: Option<Violation>) -> Report {
+        Report {
+            summary: json!({"totalRecords": 5, "p99LatencyMs": 2.5, "ignored": 1}),
+            overall_sla_verdict: Some(SlaVerdict {
+                passed,
+                violations: violation.into_iter().collect(),
+            }),
+        }
+    }
+
+    fn condition<'a>(pass: &'a Pass, type_: &str) -> (&'a str, &'a str) {
+        let c = status::find(&pass.status.conditions, type_).expect(type_);
+        (c.status.as_str(), c.reason.as_str())
+    }
+
+    fn reasons(pass: &Pass) -> Vec<&'static str> {
+        pass.notes.iter().map(|note| note.reason).collect()
+    }
+
+    #[test]
+    fn the_request_carries_the_wire_names() {
+        let test = resource(json!({"type": "ROUND_TRIP", "backend": "native",
+            "spec": {"numRecords": 1}, "sla": {"maxP99LatencyMs": 9.0}}));
+        assert_eq!(
+            request(&test),
+            json!({"type": "ROUND_TRIP", "backend": "native", "spec": {"numRecords": 1},
+                "sla": {"maxP99LatencyMs": 9.0}})
+        );
+        let scenario = resource(json!({"type": "LOAD", "scenario": {"name": "s"}}));
+        assert_eq!(
+            request(&scenario),
+            json!({"type": "LOAD", "scenario": {"name": "s"}})
+        );
+    }
+
+    #[test]
+    fn a_created_run_records_its_id_and_is_followed() {
+        let mut pass = pass();
+        let action = pass.live(&run(RunStatus::Running));
+        assert_eq!(action, Action::requeue(POLL));
+        assert_eq!(pass.status.phase, Some(Phase::Running));
+        assert_eq!(condition(&pass, "Ready"), ("False", "Running"));
+        assert_eq!(condition(&pass, "SlaPassed"), ("Unknown", "Running"));
+        assert!(pass.status.finished_at.is_none());
+    }
+
+    #[test]
+    fn done_and_passed_is_ready() {
+        let mut pass = pass();
+        pass.ended(&run(RunStatus::Done), &report(true, None));
+        assert_eq!(pass.status.phase, Some(Phase::Succeeded));
+        assert_eq!(condition(&pass, "Ready"), ("True", "RunCompleted"));
+        assert_eq!(condition(&pass, "SlaPassed"), ("True", "SlaPassed"));
+        assert!(status::find(&pass.status.conditions, "Stalled").is_none());
+        assert!(pass.status.finished_at.is_some());
+        let summary = pass.status.summary.as_ref().unwrap();
+        assert_eq!(summary.total_records, Some(5));
+        assert_eq!(summary.p99_latency_ms, Some(2.5));
+    }
+
+    #[test]
+    fn a_failed_sla_stalls_with_the_first_violation() {
+        let violation = Violation {
+            metric: "p99".to_owned(),
+            threshold: 1.0,
+            actual: 2.0,
+            reason: None,
+        };
+        let mut pass = pass();
+        pass.ended(&run(RunStatus::Done), &report(false, Some(violation)));
+        assert_eq!(pass.status.phase, Some(Phase::Failed));
+        assert_eq!(condition(&pass, "Ready"), ("False", "SlaFailed"));
+        assert_eq!(condition(&pass, "Stalled"), ("True", "SlaFailed"));
+        assert_eq!(condition(&pass, "SlaPassed"), ("False", "SlaFailed"));
+        assert_eq!(condition(&pass, "Synced"), ("True", "Finished"));
+        let ready = status::find(&pass.status.conditions, "Ready").unwrap();
+        assert_eq!(ready.message, "p99: 2 against 1");
+        assert_eq!(reasons(&pass), ["SlaFailed"]);
+    }
+
+    #[test]
+    fn a_failed_run_fails_with_no_verdict_too() {
+        let mut pass = pass();
+        let no_verdict = Report {
+            summary: Value::Null,
+            overall_sla_verdict: None,
+        };
+        pass.ended(&run(RunStatus::Failed), &no_verdict);
+        assert_eq!(condition(&pass, "Stalled"), ("True", "RunFailed"));
+        assert_eq!(pass.status.phase, Some(Phase::Failed));
+    }
+
+    #[test]
+    fn a_retried_failure_tells_once() {
+        let mut pass = pass();
+        pass.unsynced("ApiUnavailable", "down");
+        pass.unsynced("ApiUnavailable", "down");
+        assert_eq!(reasons(&pass), ["ApiUnavailable"]);
+        assert_eq!(condition(&pass, "Synced"), ("False", "ApiUnavailable"));
+        assert!(pass.status.phase.is_none());
+        assert!(pass.status.finished_at.is_none());
+    }
+
+    #[test]
+    fn missing_connection_and_old_api_are_retried_not_stalled() {
+        let mut first = pass();
+        assert_eq!(
+            first.no_connection("NoConnection", "m"),
+            Action::requeue(NO_CONNECTION_RETRY)
+        );
+        let mut second = pass();
+        assert_eq!(second.api_too_old(), Action::requeue(API_TOO_OLD_RETRY));
+        assert_eq!(second.status.phase, Some(Phase::Pending));
+        for pass in [&first, &second] {
+            assert!(status::find(&pass.status.conditions, "Stalled").is_none());
+            assert!(pass.status.finished_at.is_none());
+        }
+    }
+
+    #[test]
+    fn a_stall_writes_failed_and_finished_in_one_go() {
+        let mut pass = pass();
+        pass.stall("RunGone", "gone");
+        assert_eq!(pass.status.phase, Some(Phase::Failed));
+        assert_eq!(pass.status.finished_at.as_ref().unwrap().0, at(100));
+        assert_eq!(condition(&pass, "Synced"), ("False", "RunGone"));
+        assert_eq!(condition(&pass, "Stalled"), ("True", "RunGone"));
+    }
+
+    #[test]
+    fn an_edited_rejection_is_open_again() {
+        let mut pass = pass();
+        pass.stall("SpecRejected", "bad");
+        pass.reopen_if_edited();
+        assert!(pass.status.finished_at.is_none());
+        assert!(pass.status.phase.is_none());
+        assert!(status::find(&pass.status.conditions, "Stalled").is_none());
+    }
+
+    #[test]
+    fn settled_needs_the_current_generation() {
+        let mut test = flat();
+        assert!(!settled(&test));
+        test.status = Some(KatesTestStatus {
+            finished_at: Some(Time(at(1))),
+            observed_generation: Some(1),
+            ..KatesTestStatus::default()
+        });
+        assert!(settled(&test));
+        test.metadata.generation = Some(2);
+        assert!(!settled(&test));
+    }
+
+    #[test]
+    fn the_ttl_left_counts_from_the_end_of_the_run() {
+        let mut test = resource(json!({"type": "LOAD", "spec": {"numRecords": 1},
+            "ttlSecondsAfterFinished": 60}));
+        test.status = Some(KatesTestStatus {
+            finished_at: Some(Time(at(100))),
+            ..KatesTestStatus::default()
+        });
+        assert_eq!(ttl_left(&test, at(130)), Some(Duration::from_secs(30)));
+        assert_eq!(ttl_left(&test, at(500)), Some(Duration::ZERO));
+        assert_eq!(ttl_left(&flat(), at(130)), None);
+    }
+
+    #[test]
+    fn a_key_never_reaches_a_message() {
+        let text = ApiError::InvalidKey.to_string();
+        assert!(!text.contains("Bearer"));
+        assert_eq!(api_reason(&ApiError::InvalidKey), "InvalidKey");
+        assert_eq!(api_reason(&ApiError::MissingScope), "MissingScope");
+    }
+}
diff --git a/operator/crates/kates-operator/src/run.rs b/operator/crates/kates-operator/src/run.rs
new file mode 100644
index 00000000..fdcf0e0c
--- /dev/null
+++ b/operator/crates/kates-operator/src/run.rs
@@ -0,0 +1,577 @@
+use std::collections::BTreeSet;
+use std::path::PathBuf;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, RwLock};
+use std::time::Duration;
+
+use axum::Router;
+use axum::extract::State;
+use axum::http::{StatusCode, header};
+use axum::response::IntoResponse;
+use axum::routing::get;
+use futures::channel::oneshot;
+use futures::stream::{self, BoxStream, StreamExt as _};
+use futures::{FutureExt as _, future};
+use k8s_openapi::api::authorization::v1::{
+    ResourceAttributes, SelfSubjectAccessReview, SelfSubjectAccessReviewSpec,
+};
+use kates_crds::{KafkaCompliance, KatesTest};
+use kube::api::{Api, DynamicObject, PostParams};
+use kube::discovery;
+use kube::runtime::Controller;
+use kube::runtime::events::{Recorder, Reporter};
+use kube::runtime::reflector::{ObjectRef, Store};
+use kube::runtime::watcher;
+use kube::{Client, ResourceExt as _};
+use kube_lease_manager::{LeaseManager, LeaseManagerBuilder};
+use prometheus_client::encoding::text::encode;
+use prometheus_client::registry::Registry;
+use tokio::net::TcpListener;
+use tokio::signal::unix::{SignalKind, signal};
+use tokio::sync::watch;
+
+use crate::connection::{Connections, FALLBACK_DIR};
+use crate::context::{Context, KafkaWatch, Watched};
+use crate::crds;
+use crate::metrics::{Metrics, StoreCollector, Stores};
+use crate::reconcile::{compliance, test};
+
+const OPENMETRICS: &str = "application/openmetrics-text; version=1.0.0; charset=utf-8";
+const LEASE: &str = "kates-operator";
+// A dead holder is replaced about 15 s after its last renewal.
+const LEASE_DURATION: u64 = 15;
+const LEASE_GRACE: u64 = 5;
+const CRD_RETRY: Duration = Duration::from_secs(5);
+
+type Fallible<T = ()> = Result<T, Box<dyn std::error::Error>>;
+
+/// `KATES_OPERATOR_NAMESPACES`: `*`, or a comma list.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Scope {
+    Any,
+    Listed(BTreeSet<String>),
+}
+
+impl Scope {
+    #[must_use]
+    pub fn parse(value: &str) -> Self {
+        if value.trim() == "*" {
+            return Self::Any;
+        }
+        Self::Listed(
+            value
+                .split(',')
+                .map(str::trim)
+                .filter(|namespace| !namespace.is_empty())
+                .map(str::to_owned)
+                .collect(),
+        )
+    }
+
+    fn apis<K>(&self, client: &Client) -> Vec<Api<K>>
+    where
+        K: kube::Resource<Scope = kube::core::NamespaceResourceScope, DynamicType = ()>,
+    {
+        match self {
+            Self::Any => vec![Api::all(client.clone())],
+            Self::Listed(namespaces) => namespaces
+                .iter()
+                .map(|namespace| Api::namespaced(client.clone(), namespace))
+                .collect(),
+        }
+    }
+}
+
+/// What `/readyz` reads, and reports in its body without failing on it where it says so.
+#[derive(Default)]
+struct Health {
+    leader: AtomicBool,
+    kafka_refused: RwLock<BTreeSet<String>>,
+}
+
+struct App {
+    client: Client,
+    registry: Registry,
+    health: Arc<Health>,
+}
+
+/// Serves health and metrics, takes the Lease, and reconciles until SIGTERM or a lost Lease.
+///
+/// # Errors
+/// When no Kubernetes client can be built, port 8080 cannot be bound or the Lease cannot be
+/// managed.
+pub async fn run() -> Fallible {
+    let client = Client::try_default().await?;
+    let namespace = env_or("POD_NAMESPACE", client.default_namespace());
+    let pod = env_or("POD_NAME", "kates-operator");
+    let scope = Scope::parse(&env_or("KATES_OPERATOR_NAMESPACES", &namespace));
+    let kafka_scope = Scope::parse(&env_or("KATES_OPERATOR_KAFKA_NAMESPACES", ""));
+
+    let mut registry = Registry::default();
+    let metrics = Metrics::register(&mut registry);
+    let stores = Stores::default();
+    registry.register_collector(Box::new(StoreCollector(stores.clone())));
+    let health = Arc::new(Health::default());
+
+    let listener = TcpListener::bind(("0.0.0.0", 8080)).await?;
+    tracing::info!(address = %listener.local_addr()?, "serving health and metrics");
+    let router = router(client.clone(), registry, health.clone());
+    let server = tokio::spawn(async move {
+        axum::serve(listener, router)
+            .with_graceful_shutdown(shutdown())
+            .await
+    });
+
+    let lease = LeaseManagerBuilder::new(client.clone(), LEASE)
+        .with_namespace(&namespace)
+        .with_identity(&pod)
+        .with_duration(LEASE_DURATION)
+        .with_grace(LEASE_GRACE)
+        .with_field_manager(format!("kates-operator-{namespace}"))
+        .build()
+        .await?;
+    let (leader, renewal) = lease.watch().await;
+    let result = lead(LeadArgs {
+        client,
+        namespace,
+        pod,
+        scope,
+        kafka_scope,
+        metrics: metrics.clone(),
+        stores,
+        health: health.clone(),
+        leader: leader.clone(),
+    })
+    .await;
+
+    // Dropping the receivers makes watch() release the Lease.
+    metrics.set_leader(false);
+    drop(leader);
+    release(renewal).await;
+    server.abort();
+    result
+}
+
+async fn release(renewal: tokio::task::JoinHandle<kube_lease_manager::Result<LeaseManager>>) {
+    match renewal.await {
+        Ok(Ok(_)) => tracing::info!("lease released"),
+        Ok(Err(error)) => tracing::warn!(%error, "lease not released"),
+        Err(error) => tracing::warn!(%error, "lease task failed"),
+    }
+}
+
+struct LeadArgs {
+    client: Client,
+    namespace: String,
+    pod: String,
+    scope: Scope,
+    kafka_scope: Scope,
+    metrics: Metrics,
+    stores: Stores,
+    health: Arc<Health>,
+    leader: watch::Receiver<bool>,
+}
+
+// A fresh process is a standby until the Lease reads true; the controllers then run until it
+// reads false, and the Deployment restarts the process as a standby.
+async fn lead(args: LeadArgs) -> Fallible {
+    let LeadArgs {
+        client,
+        namespace,
+        pod,
+        scope,
+        kafka_scope,
+        metrics,
+        stores,
+        health,
+        mut leader,
+    } = args;
+    tokio::select! {
+        taken = leader.wait_for(|held| *held) => { taken?; }
+        () = shutdown() => return Ok(()),
+    }
+    health.leader.store(true, Ordering::Relaxed);
+    metrics.set_leader(true);
+    tracing::info!(%pod, "leading");
+
+    tokio::select! {
+        () = wait_for_crds(&client) => {}
+        () = shutdown() => return Ok(()),
+    }
+
+    let kafka = kafka_watch(&client, &kafka_scope).await;
+    if let Some(watch) = &kafka {
+        health
+            .kafka_refused
+            .write()
+            .expect("the health state")
+            .clone_from(&watch.refused);
+    }
+    let requests = metrics.clone();
+    let connections = Connections::new(
+        PathBuf::from(FALLBACK_DIR),
+        Arc::new(move |method, route, status| requests.api_request(method, route, status)),
+    );
+    let ctx = Arc::new(Context {
+        recorder: Recorder::new(
+            client.clone(),
+            Reporter {
+                controller: "kates-operator".to_owned(),
+                instance: Some(pod),
+            },
+        ),
+        client: client.clone(),
+        metrics,
+        connections,
+        field_manager: format!("kates-operator-{namespace}"),
+        kafka,
+    });
+
+    let mut streams: Vec<BoxStream<'static, ()>> = Vec::new();
+    for api in scope.apis::<KatesTest>(&client) {
+        let controller = Controller::new(api, watcher::Config::default())
+            .graceful_shutdown_on(lease_lost(leader.clone()))
+            .shutdown_on_signal();
+        stores
+            .tests
+            .write()
+            .expect("the stores")
+            .push(controller.store());
+        streams.push(
+            controller
+                .run(test::reconcile, test::error_policy, ctx.clone())
+                .for_each(|outcome| {
+                    if let Err(error) = outcome {
+                        tracing::debug!(%error, "controller");
+                    }
+                    future::ready(())
+                })
+                .into_stream()
+                .boxed(),
+        );
+    }
+    for api in scope.apis::<KafkaCompliance>(&client) {
+        let controller = Controller::new(api, watcher::Config::default());
+        let store = controller.store();
+        stores
+            .checks
+            .write()
+            .expect("the stores")
+            .push(store.clone());
+        let controller = kafka_triggers(controller, &client, ctx.kafka.as_ref(), &store)
+            .graceful_shutdown_on(lease_lost(leader.clone()))
+            .shutdown_on_signal();
+        streams.push(
+            controller
+                .run(compliance::reconcile, compliance::error_policy, ctx.clone())
+                .for_each(|outcome| {
+                    if let Err(error) = outcome {
+                        tracing::debug!(%error, "controller");
+                    }
+                    future::ready(())
+                })
+                .into_stream()
+                .boxed(),
+        );
+    }
+    stream::select_all(streams).collect::<()>().await;
+    Ok(())
+}
+
+// The controllers hold off until the served schema is at least this build's: a stale install
+// reconciles nothing rather than running on a schema that prunes fields it needs.
+async fn wait_for_crds(client: &Client) {
+    loop {
+        match crds::served(client)
+            .await
+            .map(|served| crds::stale(&served))
+        {
+            Ok(None) => return,
+            Ok(Some(message)) => tracing::warn!(message, "holding off"),
+            Err(error) => tracing::warn!(%error, "the served CRDs are not readable"),
+        }
+        tokio::time::sleep(CRD_RETRY).await;
+    }
+}
+
+// kube requires this trigger to be Sync, which a watch receiver's future is not.
+fn lease_lost(mut leader: watch::Receiver<bool>) -> impl Future<Output = ()> + Send + Sync {
+    let (lost, trigger) = oneshot::channel::<()>();
+    tokio::spawn(async move {
+        let _ = leader.wait_for(|held| !*held).await;
+        tracing::warn!("lease lost");
+        let _ = lost.send(());
+    });
+    trigger.map(|_| ())
+}
+
+async fn kafka_watch(client: &Client, scope: &Scope) -> Option<KafkaWatch> {
+    let group = discovery::group(client, "kafka.strimzi.io").await;
+    let resource = group
+        .ok()
+        .and_then(|group| group.recommended_kind("Kafka"))
+        .map(|(resource, _)| resource);
+    let Some(resource) = resource else {
+        tracing::info!("no Strimzi Kafka CRD: compliance runs on its interval only");
+        return None;
+    };
+    let (any_namespace, namespaces) = match scope {
+        Scope::Any => (true, BTreeSet::new()),
+        Scope::Listed(namespaces) => (false, namespaces.clone()),
+    };
+    let mut refused = BTreeSet::new();
+    for namespace in &namespaces {
+        if !may_list_kafkas(client, namespace).await {
+            tracing::warn!(
+                namespace,
+                "the operator may not list kafkas here: bind its Role"
+            );
+            refused.insert(namespace.clone());
+        }
+    }
+    Some(KafkaWatch {
+        resource,
+        any_namespace,
+        namespaces,
+        refused,
+    })
+}
+
+// Without this, kube-runtime would retry a 403 list forever, visible only in the log.
+async fn may_list_kafkas(client: &Client, namespace: &str) -> bool {
+    let review = SelfSubjectAccessReview {
+        spec: SelfSubjectAccessReviewSpec {
+            resource_attributes: Some(ResourceAttributes {
+                group: Some("kafka.strimzi.io".to_owned()),
+                resource: Some("kafkas".to_owned()),
+                verb: Some("list".to_owned()),
+                namespace: Some(namespace.to_owned()),
+                ..ResourceAttributes::default()
+            }),
+            ..SelfSubjectAccessReviewSpec::default()
+        },
+        ..SelfSubjectAccessReview::default()
+    };
+    let api: Api<SelfSubjectAccessReview> = Api::all(client.clone());
+    api.create(&PostParams::default(), &review)
+        .await
+        .ok()
+        .and_then(|answer| answer.status)
+        .is_some_and(|status| status.allowed)
+}
+
+fn kafka_triggers(
+    mut controller: Controller<KafkaCompliance>,
+    client: &Client,
+    kafka: Option<&KafkaWatch>,
+    store: &Store<KafkaCompliance>,
+) -> Controller<KafkaCompliance> {
+    let Some(kafka) = kafka else {
+        return controller;
+    };
+    let mut apis: Vec<Api<DynamicObject>> = Vec::new();
+    if kafka.any_namespace {
+        apis.push(Api::all_with(client.clone(), &kafka.resource));
+    }
+    for namespace in &kafka.namespaces {
+        if kafka.watched(namespace) == Watched::Yes {
+            apis.push(Api::namespaced_with(
+                client.clone(),
+                namespace,
+                &kafka.resource,
+            ));
+        }
+    }
+    for api in apis {
+        let store = store.clone();
+        controller = controller.watches_with(
+            api,
+            kafka.resource.clone(),
+            watcher::Config::default(),
+            move |object| checks_of(&store, &object),
+        );
+    }
+    controller
+}
+
+fn checks_of(
+    store: &Store<KafkaCompliance>,
+    kafka: &DynamicObject,
+) -> Vec<ObjectRef<KafkaCompliance>> {
+    let target = (kafka.namespace().unwrap_or_default(), kafka.name_any());
+    store
+        .state()
+        .iter()
+        .filter(|check| compliance::target(check) == target)
+        .map(|check| ObjectRef::from_obj(&**check))
+        .collect()
+}
+
+fn env_or(name: &str, default: &str) -> String {
+    std::env::var(name)
+        .ok()
+        .filter(|value| !value.is_empty())
+        .unwrap_or_else(|| default.to_owned())
+}
+
+fn router(client: Client, registry: Registry, health: Arc<Health>) -> Router {
+    Router::new()
+        .route("/healthz", get(|| async { "ok" }))
+        .route("/readyz", get(readyz))
+        .route("/metrics", get(metrics))
+        .with_state(Arc::new(App {
+            client,
+            registry,
+            health,
+        }))
+}
+
+// Fails on an unreachable API server or a stale served schema; the Lease and a Kafka refusal are
+// reported in the body and fail nothing, so a standby and a chart without the Kafka Role go Ready.
+async fn readyz(State(app): State<Arc<App>>) -> impl IntoResponse {
+    if let Err(error) = app.client.apiserver_version().await {
+        return (
+            StatusCode::SERVICE_UNAVAILABLE,
+            format!("the Kubernetes API does not answer: {error}"),
+        );
+    }
+    // A failed read is not staleness.
+    if let Ok(served) = crds::served(&app.client).await
+        && let Some(message) = crds::stale(&served)
+    {
+        return (StatusCode::SERVICE_UNAVAILABLE, message);
+    }
+    let role = if app.health.leader.load(Ordering::Relaxed) {
+        "leader"
+    } else {
+        "standby"
+    };
+    let refused = app.health.kafka_refused.read().expect("the health state");
+    let body = if refused.is_empty() {
+        format!("ok ({role})")
+    } else {
+        let namespaces = refused.iter().cloned().collect::<Vec<_>>().join(", ");
+        format!("ok ({role}); kafkas not readable in: {namespaces}")
+    };
+    (StatusCode::OK, body)
+}
+
+async fn metrics(State(app): State<Arc<App>>) -> impl IntoResponse {
+    let mut body = String::new();
+    match encode(&mut body, &app.registry) {
+        Ok(()) => ([(header::CONTENT_TYPE, OPENMETRICS)], body).into_response(),
+        Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+    }
+}
+
+async fn shutdown() {
+    let mut terminate = signal(SignalKind::terminate()).expect("a SIGTERM handler");
+    tokio::select! {
+        _ = terminate.recv() => {}
+        _ = tokio::signal::ctrl_c() => {}
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+
+    use axum::body::to_bytes;
+    use axum::extract::State;
+    use axum::http::{StatusCode, header};
+    use axum::response::IntoResponse;
+    use http::{Request, Response};
+    use kube::Client;
+    use kube::client::Body;
+    use prometheus_client::registry::Registry;
+
+    use super::{App, OPENMETRICS, Scope, metrics, readyz};
+    use crate::metrics::Metrics;
+
+    const SERVED: &str = r#"{"components":{"schemas":{
+        "io.kates.v1alpha1.KatesTest":{"description":"crd-version: 1"},
+        "io.kates.v1alpha1.KafkaCompliance":{"description":"crd-version: 1"}}}}"#;
+
+    const VERSION: &str = r#"{"major":"1","minor":"34","gitVersion":"v1.34.11","gitCommit":"c",
+        "gitTreeState":"clean","buildDate":"2026-01-01T00:00:00Z","goVersion":"go1.25",
+        "compiler":"gc","platform":"linux/amd64"}"#;
+
+    fn answering(status: u16, body: &'static str) -> Client {
+        answering_with(status, body, SERVED)
+    }
+
+    fn answering_with(status: u16, body: &'static str, openapi: &'static str) -> Client {
+        let (service, mut handle) = tower_test::mock::pair::<Request<Body>, Response<Body>>();
+        tokio::spawn(async move {
+            while let Some((request, respond)) = handle.next_request().await {
+                let (code, text) = if request.uri().path() == "/version" {
+                    (status, body)
+                } else {
+                    (200, openapi)
+                };
+                respond.send_response(
+                    Response::builder()
+                        .status(code)
+                        .body(Body::from(text.as_bytes().to_vec()))
+                        .unwrap(),
+                );
+            }
+        });
+        Client::new(service, "default")
+    }
+
+    fn app(client: Client) -> State<Arc<App>> {
+        let mut registry = Registry::default();
+        Metrics::register(&mut registry);
+        State(Arc::new(App {
+            client,
+            registry,
+            health: Arc::default(),
+        }))
+    }
+
+    #[tokio::test]
+    async fn ready_when_the_kubernetes_api_answers() {
+        let response = readyz(app(answering(200, VERSION))).await.into_response();
+        assert_eq!(response.status(), StatusCode::OK);
+    }
+
+    #[tokio::test]
+    async fn not_ready_when_it_does_not() {
+        let response = readyz(app(answering(503, "down"))).await.into_response();
+        assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
+    }
+
+    #[tokio::test]
+    async fn not_ready_on_a_stale_schema_and_it_says_what_to_run() {
+        let client = answering_with(200, VERSION, r#"{"components":{"schemas":{}}}"#);
+        let response = readyz(app(client)).await.into_response();
+        assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
+        let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        assert!(String::from_utf8_lossy(&body).contains("crds apply"));
+    }
+
+    #[tokio::test]
+    async fn a_standby_is_ready_and_says_so() {
+        let response = readyz(app(answering(200, VERSION))).await.into_response();
+        let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        assert_eq!(&body[..], b"ok (standby)");
+    }
+
+    #[test]
+    fn the_scope_is_every_namespace_or_a_list() {
+        assert_eq!(Scope::parse("*"), Scope::Any);
+        let Scope::Listed(namespaces) = Scope::parse("a, b,,") else {
+            panic!("a list");
+        };
+        assert_eq!(namespaces.into_iter().collect::<Vec<_>>(), ["a", "b"]);
+    }
+
+    #[tokio::test]
+    async fn metrics_are_openmetrics() {
+        let response = metrics(app(answering(200, VERSION))).await.into_response();
+        assert_eq!(response.headers()[header::CONTENT_TYPE], OPENMETRICS);
+        let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        assert!(String::from_utf8_lossy(&body).ends_with("# EOF\n"));
+    }
+}
diff --git a/operator/crates/kates-operator/src/status.rs b/operator/crates/kates-operator/src/status.rs
new file mode 100644
index 00000000..9b3c7e49
--- /dev/null
+++ b/operator/crates/kates-operator/src/status.rs
@@ -0,0 +1,115 @@
+//! Conditions, shared by both kinds.
+
+use std::time::Duration;
+
+use jiff::{SignedDuration, Timestamp};
+use k8s_openapi::apimachinery::pkg::apis::meta::v1::{Condition, Time};
+
+const BACKOFF_MIN: Duration = Duration::from_secs(5);
+const BACKOFF_MAX: Duration = Duration::from_mins(5);
+
+#[must_use]
+pub fn find<'a>(conditions: &'a [Condition], type_: &str) -> Option<&'a Condition> {
+    conditions.iter().find(|c| c.type_ == type_)
+}
+
+#[must_use]
+pub fn is_true(conditions: &[Condition], type_: &str) -> bool {
+    find(conditions, type_).is_some_and(|c| c.status == "True")
+}
+
+/// Sets a condition. `lastTransitionTime` moves only when `status` does, which is what the backoff
+/// reads.
+#[allow(clippy::too_many_arguments)]
+pub fn set(
+    conditions: &mut Vec<Condition>,
+    type_: &str,
+    status: &str,
+    reason: &str,
+    message: &str,
+    generation: Option<i64>,
+    now: Timestamp,
+) {
+    let existing = conditions.iter().position(|c| c.type_ == type_);
+    let last_transition_time = existing
+        .map(|i| &conditions[i])
+        .filter(|c| c.status == status)
+        .map_or(Time(now), |c| c.last_transition_time.clone());
+    let condition = Condition {
+        last_transition_time,
+        message: message.to_owned(),
+        observed_generation: generation,
+        reason: reason.to_owned(),
+        status: status.to_owned(),
+        type_: type_.to_owned(),
+    };
+    match existing {
+        Some(i) => conditions[i] = condition,
+        None => conditions.push(condition),
+    }
+}
+
+pub fn remove(conditions: &mut Vec<Condition>, type_: &str) {
+    conditions.retain(|c| c.type_ != type_);
+}
+
+/// Derived, not stored: each wait lasts as long as the failure has, which doubles the gap with no
+/// counter, survives a restart and writes no status per retry.
+#[must_use]
+pub fn backoff(conditions: &[Condition], now: Timestamp) -> Duration {
+    let failing_for = find(conditions, "Synced")
+        .filter(|c| c.status == "False")
+        .map_or(SignedDuration::ZERO, |c| {
+            now.duration_since(c.last_transition_time.0)
+        });
+    Duration::try_from(failing_for)
+        .unwrap_or(BACKOFF_MIN)
+        .clamp(BACKOFF_MIN, BACKOFF_MAX)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn at(seconds: i64) -> Timestamp {
+        Timestamp::from_second(seconds).unwrap()
+    }
+
+    #[test]
+    fn the_transition_time_moves_only_with_the_status() {
+        let mut conditions = Vec::new();
+        set(
+            &mut conditions,
+            "Synced",
+            "False",
+            "A",
+            "m",
+            Some(1),
+            at(10),
+        );
+        set(
+            &mut conditions,
+            "Synced",
+            "False",
+            "B",
+            "n",
+            Some(2),
+            at(20),
+        );
+        assert_eq!(conditions[0].last_transition_time.0, at(10));
+        assert_eq!(conditions[0].reason, "B");
+        set(&mut conditions, "Synced", "True", "C", "", Some(2), at(30));
+        assert_eq!(conditions[0].last_transition_time.0, at(30));
+        assert_eq!(conditions.len(), 1);
+    }
+
+    #[test]
+    fn backoff_follows_the_failure_between_its_bounds() {
+        let mut conditions = Vec::new();
+        assert_eq!(backoff(&conditions, at(100)), BACKOFF_MIN);
+        set(&mut conditions, "Synced", "False", "A", "m", None, at(100));
+        assert_eq!(backoff(&conditions, at(101)), BACKOFF_MIN);
+        assert_eq!(backoff(&conditions, at(160)), Duration::from_mins(1));
+        assert_eq!(backoff(&conditions, at(9000)), BACKOFF_MAX);
+    }
+}
diff --git a/operator/crates/kates-operator/src/telemetry.rs b/operator/crates/kates-operator/src/telemetry.rs
new file mode 100644
index 00000000..11e0206d
--- /dev/null
+++ b/operator/crates/kates-operator/src/telemetry.rs
@@ -0,0 +1,81 @@
+use opentelemetry::trace::{TraceContextExt as _, TraceId, TracerProvider as _};
+use opentelemetry_sdk::trace::{SdkTracer, SdkTracerProvider};
+use tracing_opentelemetry::OpenTelemetrySpanExt as _;
+use tracing_subscriber::layer::{Layer as _, SubscriberExt as _};
+use tracing_subscriber::util::SubscriberInitExt as _;
+use tracing_subscriber::{EnvFilter, Registry, fmt};
+
+/// The trace id of the current span: invalid outside one, and a metric then has no exemplar.
+#[must_use]
+pub fn current_trace_id() -> TraceId {
+    tracing::Span::current()
+        .context()
+        .span()
+        .span_context()
+        .trace_id()
+}
+
+/// Logs to stdout, JSON under `LOG_FORMAT=json`, at `RUST_LOG` (default `info`).
+pub fn init() {
+    let filter = EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new("info"));
+    let logs = if std::env::var("LOG_FORMAT").is_ok_and(|format| format == "json") {
+        fmt::layer().json().boxed()
+    } else {
+        fmt::layer().boxed()
+    };
+    Registry::default()
+        .with(filter)
+        .with(logs)
+        .with(tracing_opentelemetry::layer().with_tracer(tracer()))
+        .init();
+}
+
+// Spans get trace ids with export off too, so an exemplar needs no collector.
+fn tracer() -> SdkTracer {
+    let builder = SdkTracerProvider::builder();
+    #[cfg(feature = "telemetry")]
+    let builder = with_export(builder);
+    let provider = builder.build();
+    opentelemetry::global::set_tracer_provider(provider.clone());
+    provider.tracer("kates-operator")
+}
+
+// The endpoint comes from OTEL_EXPORTER_OTLP_ENDPOINT; unset, there is no collector to send to.
+#[cfg(feature = "telemetry")]
+fn with_export(
+    builder: opentelemetry_sdk::trace::TracerProviderBuilder,
+) -> opentelemetry_sdk::trace::TracerProviderBuilder {
+    use opentelemetry_otlp::SpanExporter;
+
+    if std::env::var_os("OTEL_EXPORTER_OTLP_ENDPOINT").is_none() {
+        return builder;
+    }
+    let exporter = SpanExporter::builder()
+        .with_tonic()
+        .build()
+        .expect("an OTLP exporter");
+    builder.with_batch_exporter(exporter)
+}
+
+#[cfg(test)]
+mod tests {
+    use opentelemetry::trace::TraceId;
+    use tracing_subscriber::layer::SubscriberExt as _;
+    use tracing_subscriber::{Registry, fmt};
+
+    use super::{current_trace_id, tracer};
+
+    #[test]
+    fn a_span_has_a_trace_id_with_export_off() {
+        let subscriber = Registry::default()
+            .with(fmt::layer())
+            .with(tracing_opentelemetry::layer().with_tracer(tracer()));
+
+        tracing::subscriber::with_default(subscriber, || {
+            assert_eq!(current_trace_id(), TraceId::INVALID);
+            let span = tracing::info_span!("reconcile");
+            let _entered = span.enter();
+            assert_ne!(current_trace_id(), TraceId::INVALID);
+        });
+    }
+}
diff --git a/operator/deny.toml b/operator/deny.toml
index 9c567ccd..13066cc4 100644
--- a/operator/deny.toml
+++ b/operator/deny.toml
@@ -17,6 +17,7 @@ allow = [
 [bans]
 multiple-versions = "allow"
 wildcards = "deny"
+allow-wildcard-paths = true
 
 [sources]
 unknown-registry = "deny"
diff --git a/operator/e2e-stack.sh b/operator/e2e-stack.sh
new file mode 100755
index 00000000..b640d961
--- /dev/null
+++ b/operator/e2e-stack.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# The smallest stack operator/e2e.sh runs on: one-broker Kafka, the Kates API from
+# charts/, and this operator with an image the cluster already holds.
+#
+#   KUBECONFIG=<scratch> operator/e2e-stack.sh <image>
+#
+# Scratch clusters only: it installs Strimzi and Kafka, as a CI job would.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+image=$1
+ns=payments
+
+./scripts/deploy-kafka-generic.sh --yes --skip-tests -f charts/kafka-cluster/values-ci.yaml
+
+# Strimzi writes the SCRAM password in Kafka's namespace, and a pod can only read its own.
+kubectl create namespace kates --dry-run=client -o yaml | kubectl apply -f -
+kubectl -n kates create secret generic kates-backend --dry-run=client -o yaml \
+  --from-literal=password="$(kubectl -n kafka get secret kates-backend -o jsonpath='{.data.password}' | base64 -d)" \
+  | kubectl apply -f -
+
+tag=$(sed -nE 's/^appVersion:[[:space:]]*"?([^"]+)"?[[:space:]]*$/\1/p' charts/kates/Chart.yaml)
+# One broker: Kates' default of three replicas would refuse every topic.
+helm upgrade --install kates charts/kates -n kates --wait --timeout 8m \
+  --set image.tag="$tag-native" \
+  --set-string defaults.replicationFactor=1,defaults.minInsyncReplicas=1 \
+  --set-json 'extraEnv=[{"name":"KATES_OUTBOX_TOPIC_REPLICATION_FACTOR","value":"1"}]'
+
+kubectl create namespace "$ns" --dry-run=client -o yaml | kubectl apply -f -
+kubectl -n "$ns" create secret generic kates-connection --dry-run=client -o yaml \
+  --from-literal=url=http://kates.kates.svc:8080 \
+  --from-literal=apiKey="$(kubectl -n kates get secret kates-api-key -o jsonpath='{.data.api-key}' | base64 -d)" \
+  | kubectl apply -f -
+
+helm upgrade --install kates-operator operator/chart -n kates-operator --create-namespace --wait --timeout 3m \
+  --set image.repository="${image%:*}" --set image.tag="${image##*:}" --set image.pullPolicy=Never \
+  --set "watchNamespaces={$ns}" --set 'kafka.namespaces={kafka}'
diff --git a/operator/e2e.sh b/operator/e2e.sh
new file mode 100755
index 00000000..5745e272
--- /dev/null
+++ b/operator/e2e.sh
@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# End-to-end checks of a running operator, against a real Kates API and Kafka.
+#
+#   KUBECONFIG=<scratch> operator/e2e.sh [namespace] [kafka namespace] [kafka name]
+#
+# The namespace must be watched and hold a working kates-connection, as
+# operator/e2e-stack.sh leaves it. Each check
+# creates its own resources under a unique name and asserts what the plan says.
+set -uo pipefail
+
+ns=${1:-payments}
+kafka_ns=${2:-kafka}
+kafka_name=${3:-krafter}
+k=(kubectl -n "$ns")
+failed=0
+suffix=$(date +%s)
+
+pass() { echo "  ok    $1"; }
+fail() { echo "  FAIL  $1"; failed=1; }
+check() { # check <label> <expected> <actual>
+  if [ "$2" = "$3" ]; then pass "$1"; else fail "$1: expected '$2', got '$3'"; fi
+}
+get() { "${k[@]}" get "$1" "$2" -o jsonpath="$3" 2>/dev/null; }
+condition() { get katestest "$1" "{.status.conditions[?(@.type=='$2')].status}/{.status.conditions[?(@.type=='$2')].reason}"; }
+create() { # create <name> <spec as flow yaml>
+  printf 'apiVersion: kates.io/v1alpha1\nkind: KatesTest\nmetadata: {name: %s}\nspec: %s\n' "$1" "$2" | "${k[@]}" apply -f - >/dev/null
+}
+finished() { "${k[@]}" wait --for=jsonpath='{.status.finishedAt}' "katestest/$1" --timeout="${2:-180s}" >/dev/null; }
+
+echo "== a run that meets its SLA"
+name=ok-$suffix
+create "$name" '{type: LOAD, spec: {numRecords: 2000, recordSize: 128}, sla: {minRecordsProcessed: 100}}'
+finished "$name"
+check "phase" Succeeded "$(get katestest "$name" '{.status.phase}')"
+check "Ready" True/RunCompleted "$(condition "$name" Ready)"
+check "SlaPassed" True/SlaPassed "$(condition "$name" SlaPassed)"
+check "no finalizer left" "" "$(get katestest "$name" '{.metadata.finalizers}')"
+[ -n "$(get katestest "$name" '{.status.summary.totalRecords}')" ] && pass "summary" || fail "summary"
+"${k[@]}" wait --for=condition=Ready "katestest/$name" --timeout=0 >/dev/null 2>&1
+check "the gate exits 0" 0 $?
+
+echo "== a missed SLA fails the gate"
+name=sla-$suffix
+create "$name" '{type: LOAD, spec: {numRecords: 2000, recordSize: 128}, sla: {minThroughputRecPerSec: 99999999}}'
+finished "$name"
+check "phase" Failed "$(get katestest "$name" '{.status.phase}')"
+check "Stalled" True/SlaFailed "$(condition "$name" Stalled)"
+check "SlaPassed" False/SlaFailed "$(condition "$name" SlaPassed)"
+"${k[@]}" wait --for=condition=Ready "katestest/$name" --timeout=0 >/dev/null 2>&1
+check "the gate exits 1" 1 $?
+
+echo "== a request the API refuses, then edited"
+name=rejected-$suffix
+create "$name" '{type: LOAD, spec: {numRecords: -5}}'
+finished "$name" 30s
+check "Stalled" True/SpecRejected "$(condition "$name" Stalled)"
+check "no run" "" "$(get katestest "$name" '{.status.runId}')"
+"${k[@]}" patch katestest "$name" --type=merge -p '{"spec":{"spec":{"numRecords":1000}}}' >/dev/null
+"${k[@]}" wait --for=condition=Ready "katestest/$name" --timeout=120s >/dev/null
+check "the edit runs" Succeeded "$(get katestest "$name" '{.status.phase}')"
+check "Stalled cleared" "/" "$(condition "$name" Stalled)"
+
+echo "== what the CRD refuses"
+out=$("${k[@]}" patch katestest "ok-$suffix" --type=merge -p '{"spec":{"spec":{"numRecords":1}}}' 2>&1)
+[[ $out == *"immutable"* ]] && pass "a started spec is frozen" || fail "frozen: $out"
+out=$(create typo-$suffix '{type: LOAD, spec: {numRecordz: 5}}' 2>&1)
+[[ $out == *"unknown field"* ]] && pass "a mistyped key" || fail "typo: $out"
+out=$(create both-$suffix '{type: LOAD, spec: {numRecords: 1}, scenario: {name: s}}' 2>&1)
+[[ $out == *"exactly one"* ]] && pass "spec and scenario together" || fail "both: $out"
+
+echo "== the TTL deletes a finished resource"
+name=ttl-$suffix
+create "$name" '{type: LOAD, spec: {numRecords: 500}, ttlSecondsAfterFinished: 5}'
+finished "$name"
+sleep 9
+check "gone" "" "$(get katestest "$name" '{.metadata.name}')"
+
+echo "== deleting a live run cancels it"
+name=live-$suffix
+create "$name" '{type: LOAD, spec: {numRecords: 500000000, recordSize: 1024}}'
+for _ in $(seq 1 30); do
+  id=$(get katestest "$name" '{.status.runId}')
+  [ -n "$id" ] && [ "$(get katestest "$name" '{.status.phase}')" = Running ] && break
+  sleep 2
+done
+[ -n "$id" ] && pass "running as $id" || fail "never ran"
+"${k[@]}" delete katestest "$name" --timeout=90s >/dev/null
+check "deleted" "" "$(get katestest "$name" '{.metadata.name}')"
+"${k[@]}" get events --field-selector reason=Cancelled -o jsonpath='{.items[*].message}' | grep -q "$id" \
+  && pass "Cancelled event" || fail "no Cancelled event for $id"
+
+echo "== pause"
+name=paused-$suffix
+printf 'apiVersion: kates.io/v1alpha1\nkind: KatesTest\nmetadata: {name: %s, annotations: {kates.io/pause-reconciliation: "true"}}\nspec: {type: LOAD, spec: {numRecords: 500}}\n' "$name" | "${k[@]}" apply -f - >/dev/null
+sleep 6
+check "no run while paused" "" "$(get katestest "$name" '{.status.runId}')"
+check "Reconciling" False/Paused "$(condition "$name" Reconciling)"
+"${k[@]}" annotate katestest "$name" kates.io/pause-reconciliation- >/dev/null
+finished "$name"
+check "runs once resumed" Succeeded "$(get katestest "$name" '{.status.phase}')"
+
+echo "== a compliance check, then its spec edited"
+name=rules-$suffix
+verdict() { "${k[@]}" wait --for=jsonpath="{.status.verdict}=$2" "kafkacompliance/$1" --timeout=120s >/dev/null; }
+compliant() { get kafkacompliance "$1" "{.status.conditions[?(@.type=='Compliant')].status}/{.status.conditions[?(@.type=='Compliant')].reason}"; }
+printf 'apiVersion: kates.io/v1alpha1\nkind: KafkaCompliance\nmetadata: {name: %s}\nspec: {interval: 1h, reference: {target: {namespace: %s, name: %s}, brokers: {count: {min: 1}}}}\n' \
+  "$name" "$kafka_ns" "$kafka_name" | "${k[@]}" apply -f - >/dev/null
+verdict "$name" PASS
+check "Compliant" True/PASS "$(compliant "$name")"
+[ -n "$(get kafkacompliance "$name" '{.status.nextCheckAt}')" ] && pass "next check set" || fail "no next check"
+"${k[@]}" patch kafkacompliance "$name" --type=merge -p '{"spec":{"reference":{"brokers":{"count":{"min":9999}}}}}' >/dev/null
+verdict "$name" FAIL
+check "Compliant after the edit" False/FAIL "$(compliant "$name")"
+[ -n "$(get kafkacompliance "$name" '{.status.failed[0].rule}')" ] && pass "failed rule named" || fail "no failed rule"
+"${k[@]}" get events --field-selector reason=ComplianceFailed,involvedObject.name="$name" -o name | grep -q . \
+  && pass "ComplianceFailed event" || fail "no ComplianceFailed event"
+"${k[@]}" delete kafkacompliance "$name" --timeout=30s >/dev/null
+
+exit $failed
diff --git a/operator/examples/compliance.yaml b/operator/examples/compliance.yaml
new file mode 100644
index 00000000..eae1f243
--- /dev/null
+++ b/operator/examples/compliance.yaml
@@ -0,0 +1,11 @@
+apiVersion: kates.io/v1alpha1
+kind: KafkaCompliance
+metadata:
+  name: krafter-rules
+spec:
+  interval: 1h
+  reference:
+    target: {namespace: kafka, name: krafter}
+    brokers:
+      count: {min: 3}
+      zones: {min: 3}
diff --git a/operator/examples/load-test.yaml b/operator/examples/load-test.yaml
new file mode 100644
index 00000000..dc9fdc08
--- /dev/null
+++ b/operator/examples/load-test.yaml
@@ -0,0 +1,12 @@
+apiVersion: kates.io/v1alpha1
+kind: KatesTest
+metadata:
+  name: load-gate
+spec:
+  type: LOAD
+  spec:
+    numRecords: 5000
+    recordSize: 256
+    acks: all
+  sla:
+    minRecordsProcessed: 1000