Roadmap: quality baseline (reference: openvox-operator)

[slauger]

Tracking issue for bringing crashloop-operator to the same quality baseline as openvox-operator. Work top to bottom; each unchecked box is the next issue to pick up. Design decisions on record: no automatic scale-up recovery (GitOps concern), no notification integrations, most restrictive policy wins, metrics are low priority.

Phase 1 - CI and repo foundation

• ci: pin golangci-lint config, run helm-unittest, race detector and coverage gate #21 golangci-lint config, helm-unittest in CI, race detector, coverage gate
• chore: align renovate.json with openvox-operator (automerge, groups, drop broken postUpgradeTasks) #24 renovate alignment (automerge, drop broken postUpgradeTasks)
• chore: repo hygiene #33 repo hygiene

Phase 2 - API and design

• fix(api): CrashLoopPolicy is Namespaced but acts cluster-wide #18 CRD scope: Namespaced but cluster-wide behavior
• fix(api): v1alpha1 type cleanup (bool pointers, enums, list markers, status design) #19 v1alpha1 type cleanup
• feat(controller): define multi-policy semantics - most restrictive policy wins #20 multi-policy semantics (most restrictive wins)
• feat: add validation webhook for CrashLoopPolicy — reject invalid durationThreshold #4 validation (CEL markers and/or webhook)

Phase 3 - Controller and tests

• perf(controller): predicates, indexed lookups and error surfacing in the reconcile loop #29 predicates, indexed lookups, error surfacing
• test: envtest-based integration tests and e2e smoke test #30 envtest integration tests and e2e smoke test

Phase 4 - Supply chain and release

• feat(ci): sign Helm chart with cosign and attest the image manifest index #23 chart signing (cosign) and manifest attestation
• feat(ci): validate released images with Conforma #35 Conforma validation of released images
• ci: generate chart README with helm-docs and values.schema.json with drift gates #22 helm-docs README and values.schema.json with drift gates
• feat(helm): chart completeness and correctness #26 chart completeness and RBAC drift check
• feat(helm): prepare Artifact Hub listing #25 Artifact Hub preparation
• fix(build): Containerfile improvements (build metadata, trimpath, cache mounts) #31 Containerfile improvements

Phase 5 - Docs and cleanup

• docs: add SECURITY.md and CONTRIBUTING.md #27 SECURITY.md and CONTRIBUTING.md
• chore: config/ directory cleanup (kustomize wiring or removal, generated RBAC) #32 config/ directory cleanup
• docs: complete README and add a documentation site #28 README completeness and documentation site

Phase 6 - Correctness

Found while researching detection improvements; #64 is the only one where
documented behaviour does not work today.

• fix(controller): durationThreshold never fires for CrashLoopBackOff #64 durationThreshold never fires for CrashLoopBackOff
• fix(api): enum on a status field can block all status writes #66 enum on a status field can block all status writes
• fix(controller): owner resolution picks the wrong reference and the wrong Job #65 owner resolution picks the wrong reference and the wrong Job

Phase 7 - Detection and behaviour

• feat(controller): detect slow restart loops via termination reason #67 detect slow restart loops via termination reason
• feat(controller): change replicas through the scale subresource #68 change replicas through the scale subresource
• perf(controller): requeue at the deadline instead of a fixed interval #69 requeue at the deadline instead of a fixed interval
• feat(api): correlate failures by container name across replicas #70 correlate failures by container name across replicas

Phase 8 - Features (later)

• feat: expose Prometheus metrics — scaled_down_total, policy_evaluations_total, etc. #6 Prometheus metrics (low priority by decision)
• feat: detect permanently Pending pods (unschedulable, PVC issues) #14 permanently Pending pod detection (future consideration)

Maintainer-only steps (not to be done by automation)

• Merge develop into main and cut releases - handled by the maintainer, not by automation
• Optional: set LLM_API_KEY secret and LLM_API_URL / LLM_MODEL variables for AI-generated release PR descriptions (workflow falls back to a generated summary without them)
• Artifact Hub registration - done, repositoryID is in artifacthub-repo.yml