Set the chart's placeholder version to 0.2.0

make helm-package passes --version and --app-version from the tag, so
these fields decide nothing about what is published -- but a tree
heading for v0.2.0 that still says 0.1.2 tells its reader something
false. Same as 738c210 and 0e3118d before it.

CLAUDE.md

@@ -36,11 +36,9 @@ charts --force` after `config/` changes, then re-review — `--force` does not t
 importantly the optional `terdutServer` block, DESIGN.md §10). It installs the operator +
 CRDs + RBAC, and optionally one `TerdutServer` CR (`terdutServer.enabled`, off by default).
 
-**One manual step the release skill's own automation does not cover**: `release-preflight`
-expects an existing `terdut-operator/` entry under `Ryuvia/charts` to bump on release
-(steps 8-10 of the skill). There is no such entry yet — this repo's first-ever release
-can publish its own image and chart (the `test`/`image`/`chart`/`scan-image` jobs), but
-the wrapper-chart bump and PR will fail until someone creates that initial wrapper entry
-in `Ryuvia/charts` by hand, the same one-time step every other onboarded repo already had
-done for it before its own first release. That's a deliberate decision to deploy this
-operator for real, not something to do as a side effect of finishing this stage.
+That one-time manual step — hand-creating the initial `terdut-operator/` wrapper entry
+under `Ryuvia/charts`, since `chart-bump` only ever bumps an existing one — is done. It
+happened during this repo's actual first release (v0.1.1, 2026-10-01; v0.1.0 published but
+never deployed anywhere, after its own `scan-image` found a CVE in the grpc version it had
+just bumped to). Every release since bumps that wrapper entry like any other onboarded
+repo's.

DESIGN.md

@@ -50,6 +50,14 @@ it just created, never a server something else already bootstrapped first.
   that needs a live look at another object (e.g. "does this teamRef exist")
   is a status condition, not an admission rejection — keeps v1 to a
   controller-only deployment with no cert-manager/webhook dependency.
+- **Never manages external exposure/ingress for `TerdutServer`, in any
+  form — a permanent non-goal, not a staged one.** The operator creates a
+  plain `ClusterIP` Service (§4.1) and stops there: no `Ingress`, no
+  Gateway API `HTTPRoute`, no Istio `VirtualService`, nothing. Some
+  installs won't expose `TerdutServer` outside the cluster at all; others
+  will use whichever of those mechanisms already fits their cluster. That
+  choice belongs to whoever deploys it, not to this operator — see
+  `examples/networking` for worked (but not operator-managed) examples.
 
 ## 2. The README's open questions, resolved
 
@@ -149,7 +157,6 @@ spec:
   networking:
     hostname: terdut.example.com
     servicePort: 8080
-    gatewayListener: ""            # same semantics as chart's networking.listener
   database:
     dsn: "postgres://terdut@terdut-postgres:5432/terdut?sslmode=require"   # mutually exclusive with postgresClusterRef
     passwordSecretRef: {name: terdut.terdut-postgres.credentials.postgresql.acid.zalan.do, key: password}
@@ -188,6 +195,20 @@ spec:
       # selector:       # required, and only meaningful, when from: Selector
       #   matchLabels:
       #     terdut.ryuvia.com/allowed: "true"
+  # Pod-level customization of the Deployment -- all optional, direct corev1
+  # passthrough throughout (see PodSpec's own doc comment). A representative
+  # subset:
+  pod:
+    resources:
+      requests: {cpu: 100m, memory: 128Mi}
+      limits: {memory: 256Mi}
+    tolerations:
+      - key: dedicated
+        operator: Equal
+        value: terdut
+        effect: NoSchedule
+    disruptionBudget:
+      minAvailable: 1       # mutually exclusive with maxUnavailable
 status:
   conditions: [...]                 # Ready, DatabaseReady, Bootstrapped
   observedGeneration: 3
@@ -214,6 +235,25 @@ per-name allowlist (no "and only these teams") — namespace-level consent is
 the right granularity here, same reasoning as `ListenerSet`: the namespace
 is the tenancy boundary, not the object.
 
+`spec.pod` is pod-level customization of the Deployment, all optional and
+directly reusing corev1 types wherever corev1 already models the knob
+exactly (`tolerations`, `affinity`, `topologySpreadConstraints`,
+`resources`, `securityContext`/`containerSecurityContext`, `extraEnv`/
+`extraEnvFrom`, `extraVolumes`/`extraVolumeMounts`, `imagePullSecrets`) —
+no custom wrapper buys anything for any of these, matching how
+CloudNativePG and the Zalando postgres-operator both expose the same
+knobs. `affinity` is pure user-supplied passthrough, not a
+toggle-plus-generated-default the way a multi-replica-aware operator's
+pod anti-affinity typically is: this operator never auto-generates
+affinity of its own, since `replicas` above 1 isn't a supported topology
+(the sweeper/notifier singleton constraint, §4.1's own illustrative YAML
+comment). `spec.pod.disruptionBudget` is the one field here that isn't a
+straight PodTemplateSpec knob — when set, the controller reconciles a
+`PodDisruptionBudget` selecting this `TerdutServer`'s pods; clearing it
+deletes any it previously created (§7). `minAvailable`/`maxUnavailable`
+are mutually exclusive, `+kubebuilder:validation:XValidation`-guarded the
+same way as `spec.database`'s own `dsn`/`postgresClusterRef` rule.
+
 ### 4.2 `TerdutTeam`
 
 ```yaml
@@ -566,13 +606,40 @@ when nothing ever crosses into a tenant namespace in the first place.
    Secret is updated in place. No DB-level workaround, no re-triggering a
    single-shot endpoint that can't fire twice (which is what made rotation
    unworkable under the old `/api/bootstrap`-only design).
+7. **Operator mode** (`TERDUT_OPERATOR_MODE`, terdut-server's own
+   deploy-time flag, off by default) is the complementary half of this
+   trust model: it makes terdut-server itself refuse a *human* write (a
+   session or a user's own API key) on a route, while a service account's
+   — this operator's — still goes through. Confirmed against source
+   (`internal/api/middleware.go`'s `OperatorModeBlock`,
+   `internal/api/router.go`'s `opMode` wrapper): the blocked set is exactly
+   team create/rename/delete, a team's OIDC-group binding, its escalation
+   policy, its dead man's switches, and its integrations — precisely the
+   resources `TerdutTeam`, `TerdutEscalationRule`, `TerdutDeadmanSwitch` and
+   `TerdutAlertSource` manage, and nothing more. **Deliberately not
+   blocked, confirmed against the same router**: team membership and
+   invites (the router's own comment: "membership is deliberately never
+   gitops-managed"), and the on-call schedule/rota
+   (`/api/teams/{teamID}/schedule`, `/api/schedule/current`) — neither
+   route carries the `opMode` wrapper at all. A human can still add or
+   remove a team member, or assign who's on call, on a server running in
+   operator mode; only the CRD-shaped resources above are locked to
+   GitOps. This isn't a gap to close — it's the same boundary §4.2 already
+   draws for membership, confirmed to hold on the server side too, not
+   just stated as an intent here.
 
 ## 7. Ownership, status, garbage collection
 
 - Every generated object that lives in the *same* namespace as the CR that
-  caused it (Deployment, Service, webhook Secret) carries a standard
-  `metav1.OwnerReference` — GC handles these, no finalizer needed. The two
-  credential Secrets from §6 are the one exception: they live in the
+  caused it (Deployment, Service, webhook Secret, and `TerdutServer`'s own
+  PodDisruptionBudget) carries a standard `metav1.OwnerReference` — GC
+  handles these, no finalizer needed. PodDisruptionBudget is the one
+  member of that list that's conditionally created/deleted rather than
+  always present: it exists only while `spec.pod.disruptionBudget` is set,
+  and the controller deletes it itself the moment that field is cleared
+  (it doesn't wait on GC for that case, only for the `TerdutServer` being
+  deleted outright). The two credential Secrets from §6 are the one
+  exception to OwnerReference-based cleanup generally: they live in the
   operator's own namespace regardless of where their owning CR lives, so
   `OwnerReference` doesn't apply (cross-namespace) and cleanup instead runs
   through that CR's finalizer directly, alongside the server-side DELETE
@@ -619,10 +686,10 @@ documented and tested operationally:
 
 - The operator's own ServiceAccount needs, per namespace it's granted:
   `get/list/watch/create/update/patch/delete` on `Deployments`, `Services`
-  it owns, and `get/list/watch` on `postgresql.acid.zalan.do` (optional,
-  degrade gracefully if absent per §8), plus cluster-wide `get/list` on
-  `Namespace` (labels only, for `allowedTeams: {from: Selector}` evaluation
-  — §4.1, §4.6).
+  and `PodDisruptionBudgets` it owns, and `get/list/watch` on
+  `postgresql.acid.zalan.do` (optional, degrade gracefully if absent per
+  §8), plus cluster-wide `get/list` on `Namespace` (labels only, for
+  `allowedTeams: {from: Selector}` evaluation — §4.1, §4.6).
 - **Two different `Secret` scopes, not one — corrected from an earlier draft
   of this section.** That earlier draft said `Secret` access was "scoped to
   the operator's own namespace only... nowhere else," reasoning that with
@@ -746,8 +813,29 @@ what it was, a separate install, until someone deletes it.
   integration/policy/switch to a different team in place regardless, so
   retargeting one onto a live child isn't a supported operation in v1 —
   delete and recreate the CR instead.
+- `TerdutServerSpec.OIDC` has no `trustEmail` field (nor `usernameClaim`,
+  `emailClaim`, `groupsClaim` — the "rather than being added here
+  speculatively" fields its own doc comment already names), unlike
+  `charts/terdut-server`'s own chart, which sets `oidc.trustEmail: true`
+  for the production install specifically because Authentik reports
+  `email_verified: false` and without it a user's first SSO sign-in
+  creates a second, empty account instead of linking to their existing
+  one (`terdut-server/README.md`'s own account of this). Found by
+  actually trying to stand up a second real `TerdutServer` against the
+  same Authentik provider (`terdut-demo`, `Ryuvia/charts#275`), not by
+  inspection: that install's OIDC config is otherwise a straight copy of
+  production's and runs with terdut-server's own default (`trustEmail:
+  false`) regardless, since the CRD has nowhere to put the override.
+  Worth closing if a second real OIDC install becomes routine rather than
+  a one-off exercise.
 - Gitops-managed team *membership* (see §4.2).
 - Automatic Deployment restart on upstream Postgres credential rotation.
+- `spec.pod.priorityClassName`, pod-label passthrough beyond
+  `spec.pod.annotations`, and a HorizontalPodAutoscaler for `TerdutServer`
+  — all considered alongside §4.1's `spec.pod` and explicitly left out of
+  that round: an HPA in particular would actively contradict
+  `spec.replicas`'s own stance that this operator doesn't support more
+  than one replica (the sweeper/notifier singleton constraint).
 - Admission webhooks / CEL-only validation limits (e.g. verifying a
   `teamRef` exists at admission time rather than surfacing it as a status
   condition after the fact).

README.md

@@ -34,3 +34,11 @@ DESIGN.md §4.1, §4.6.
   - `teamRef` (DESIGN.md §4.5)
   - URL/key are generated by the server at creation and surfaced only via a
     generated Secret, never set explicitly
+
+## Demo
+
+[`examples/demo`](./examples/demo) wires one of every CRD above together
+— two teams, each with an escalation rule, a dead man's switch and an
+alert source — plus a script that fires synthetic Alertmanager webhooks
+at it, so you can watch real incidents open, escalate and resolve without
+a real Alertmanager anywhere in the picture.

ROADMAP.md

@@ -72,15 +72,17 @@ New commits build forward over the old ones; no git history rewrite.
   individual keys, so there's nothing to undo there regardless.
 - RBAC: read-only watch on `postgresql.acid.zalan.do`, degrading gracefully
   if that CRD isn't installed (§8, §9).
-- Shipped, scoped down from §8's full ambition in two ways, both called out
-  in code rather than silently dropped: no live watch on the Zalando-
+- Shipped, scoped down from §8's full ambition in one way, called out in
+  code rather than silently dropped: no live watch on the Zalando-
   generated credentials Secret for rotation (relies on the periodic resync
-  to notice eventually, higher latency than a watch); no Gateway API
-  `HTTPRoute` creation from `spec.networking.hostname`/`gatewayListener`
-  (needs the Gateway API types as a new dependency, and nothing about
-  proving a `TerdutServer` boots and bootstraps a real server depends on
-  external ingress existing). Both are near-term follow-ups, not deferred
-  to a later stage.
+  to notice eventually, higher latency than a watch). A near-term
+  follow-up, not deferred to a later stage.
+- External exposure (a Gateway API `HTTPRoute` from
+  `spec.networking.hostname`) was originally sketched here too, as a
+  second near-term follow-up alongside the one above. It's since become an
+  explicit, permanent non-goal instead (DESIGN.md §1): the operator will
+  never manage ingress/exposure for `TerdutServer` in any form. See
+  `examples/networking` for how to do that yourself.
 - `envtest` covering Deployment/Service reconciliation and both database
   paths — the Zalando path needs that CRD's schema vendored into the test
   environment (there's no real `postgres-operator` controller in `envtest`,

api/v1alpha1/terdutserver_types.go

@@ -1,8 +1,10 @@
 package v1alpha1
 
 import (
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/intstr"
 )
 
 // SecretKeyRef names one data key inside a Secret. Every use of this type in
@@ -29,33 +31,28 @@ type ImageSpec struct {
 	Tag string `json:"tag"`
 }
 
-// NetworkingSpec is how this TerdutServer is reached from outside the
-// cluster.
-//
-// hostname/gatewayListener describe the intended Gateway API HTTPRoute
-// (matching charts/terdut-server's own templates/httpproxy.yaml, despite its
-// name — that chart carries a Gateway API HTTPRoute, not a Contour
-// HTTPProxy), but creating that HTTPRoute isn't implemented yet: it needs
-// the Gateway API types as a new dependency, and nothing about proving a
-// TerdutServer boots and bootstraps a real server depends on external
-// ingress existing. Tracked as a near-term follow-up, not deferred to a
-// later ROADMAP.md stage the way Deployment/database/bootstrap once were.
+// NetworkingSpec configures terdut-server itself and the plain ClusterIP
+// Service the operator creates in front of it. It does not expose
+// TerdutServer outside the cluster in any way, and never will (DESIGN.md
+// §1 -- a permanent non-goal, not a staged one): exposing it is entirely up
+// to whoever deploys it -- a Gateway API HTTPRoute, a plain Ingress, an
+// Istio VirtualService, or nothing at all if it should stay cluster-
+// internal. See examples/networking for worked examples against the
+// Service this creates.
 type NetworkingSpec struct {
-	// hostname the HTTPRoute will carry once it exists.
+	// hostname is terdut-server's own public URL (TERDUT_PUBLIC_URL) --
+	// used for absolute links terdut-server generates itself
+	// (notifications, OIDC redirect URIs), not read by this operator for
+	// anything ingress-related. Set it to whatever hostname your own
+	// exposure mechanism, if any, actually serves this on.
 	// +optional
 	Hostname string `json:"hostname,omitempty"`
 
-	// servicePort is both the Service's port and the HTTPRoute's backend
-	// port once it exists. Defaults to 8080, matching the chart's own
-	// service.port default.
+	// servicePort is both the container's port and the ClusterIP Service's
+	// port. Defaults to 8080, matching the chart's own service.port default.
 	// +kubebuilder:default=8080
 	// +optional
 	ServicePort int32 `json:"servicePort,omitempty"`
-
-	// gatewayListener is the HTTPRoute's sectionName once it exists. Empty
-	// attaches to every matching listener, including plaintext HTTP.
-	// +optional
-	GatewayListener string `json:"gatewayListener,omitempty"`
 }
 
 // PostgresClusterRef names a Zalando postgres-operator `postgresql` CR
@@ -190,6 +187,109 @@ type AllowedTeams struct {
 	Namespaces AllowedTeamsNamespaces `json:"namespaces,omitempty"`
 }
 
+// PodDisruptionBudgetSpec configures an optional PodDisruptionBudget for
+// this TerdutServer's Deployment. Exactly one of minAvailable or
+// maxUnavailable may be set, matching policyv1.PodDisruptionBudgetSpec's own
+// upstream rule (both wrap intstr.IntOrString unchanged here -- this is pure
+// passthrough, not reshaped) and mirroring DatabaseSpec's own
+// dsn/postgresClusterRef mutual-exclusion pattern. Clearing this field
+// deletes any PodDisruptionBudget the controller previously created for this
+// TerdutServer (DESIGN.md §7).
+// +kubebuilder:validation:XValidation:rule="(has(self.minAvailable) ? 1 : 0) + (has(self.maxUnavailable) ? 1 : 0) == 1",message="exactly one of minAvailable or maxUnavailable must be set"
+type PodDisruptionBudgetSpec struct {
+	// minAvailable -- mutually exclusive with maxUnavailable.
+	// +optional
+	MinAvailable *intstr.IntOrString `json:"minAvailable,omitempty"`
+
+	// maxUnavailable -- mutually exclusive with minAvailable.
+	// +optional
+	MaxUnavailable *intstr.IntOrString `json:"maxUnavailable,omitempty"`
+}
+
+// PodSpec is pod-level customization of the Deployment this TerdutServer
+// creates. Fields here directly reuse corev1 types wherever corev1 already
+// models the knob exactly, rather than wrapping (unlike SecretKeyRef's own
+// "wrap only when a round-trip through a different type buys something"
+// standard would suggest at first glance -- none of these do: Tolerations,
+// Affinity, TopologySpreadConstraints, Resources, SecurityContext, EnvVar,
+// EnvFromSource, Volume, VolumeMount and LocalObjectReference are all passed
+// straight through to the pod template with no added semantics, matching how
+// CloudNativePG and the Zalando postgres-operator both expose the same
+// knobs).
+type PodSpec struct {
+	// annotations are merged onto the pod template's own metadata.
+	// Operator-managed labels (labelsFor) are never touched by this field.
+	// +optional
+	Annotations map[string]string `json:"annotations,omitempty"`
+
+	// +optional
+	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
+
+	// +optional
+	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
+
+	// affinity covers node affinity, pod affinity and pod anti-affinity in
+	// one field -- unlike a multi-replica-aware operator, this one never
+	// generates a default anti-affinity itself (replicas above 1 isn't a
+	// supported topology, see TerdutServerSpec.Replicas's own doc comment),
+	// so this is pure user-supplied passthrough, not a toggle-plus-generated-
+	// default.
+	// +optional
+	Affinity *corev1.Affinity `json:"affinity,omitempty"`
+
+	// +optional
+	TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"`
+
+	// resources applied to the main terdut-server container. Unset today --
+	// this field closes a pre-existing gap, not a behavior change for
+	// anyone not setting it.
+	// +optional
+	Resources corev1.ResourceRequirements `json:"resources,omitempty"`
+
+	// securityContext is pod-level.
+	// +optional
+	SecurityContext *corev1.PodSecurityContext `json:"securityContext,omitempty"`
+
+	// containerSecurityContext applies to the main terdut-server container
+	// only -- not wait-for-postgres, which runs a stock postgres image this
+	// operator doesn't control the entrypoint of. No implicit defaults are
+	// merged underneath it.
+	// +optional
+	ContainerSecurityContext *corev1.SecurityContext `json:"containerSecurityContext,omitempty"`
+
+	// serviceAccountName. Defaults to "default", same as any pod that
+	// doesn't set it.
+	// +optional
+	ServiceAccountName string `json:"serviceAccountName,omitempty"`
+
+	// extraEnv is appended after the fixed env vars buildEnv produces.
+	// +optional
+	ExtraEnv []corev1.EnvVar `json:"extraEnv,omitempty"`
+
+	// +optional
+	ExtraEnvFrom []corev1.EnvFromSource `json:"extraEnvFrom,omitempty"`
+
+	// extraVolumes are added to the pod spec; pair with extraVolumeMounts to
+	// actually mount one on the main container.
+	// +optional
+	ExtraVolumes []corev1.Volume `json:"extraVolumes,omitempty"`
+
+	// extraVolumeMounts are added to the main terdut-server container only
+	// -- not wait-for-postgres.
+	// +optional
+	ExtraVolumeMounts []corev1.VolumeMount `json:"extraVolumeMounts,omitempty"`
+
+	// +optional
+	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
+
+	// disruptionBudget, when set, causes the controller to reconcile a
+	// policyv1.PodDisruptionBudget selecting this TerdutServer's pods.
+	// Removing this field deletes any PodDisruptionBudget the controller
+	// previously created.
+	// +optional
+	DisruptionBudget *PodDisruptionBudgetSpec `json:"disruptionBudget,omitempty"`
+}
+
 // TerdutServerSpec defines the desired state of TerdutServer.
 //
 // The operator creates and owns every TerdutServer it manages (DESIGN.md
@@ -237,6 +337,11 @@ type TerdutServerSpec struct {
 	// this CRD's schema doesn't need a breaking change to grow it later.
 	// +optional
 	AllowedTeams AllowedTeams `json:"allowedTeams,omitempty"`
+
+	// pod is pod-level customization of the Deployment this TerdutServer
+	// creates (DESIGN.md §4.1).
+	// +optional
+	Pod PodSpec `json:"pod,omitempty"`
 }
 
 // Condition types this controller sets on TerdutServer.

api/v1alpha1/zz_generated.deepcopy.go

@@ -5,8 +5,10 @@
 package v1alpha1
 
 import (
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/intstr"
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
@@ -210,6 +212,128 @@ func (in *OIDCSpec) DeepCopy() *OIDCSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodDisruptionBudgetSpec) DeepCopyInto(out *PodDisruptionBudgetSpec) {
+	*out = *in
+	if in.MinAvailable != nil {
+		in, out := &in.MinAvailable, &out.MinAvailable
+		*out = new(intstr.IntOrString)
+		**out = **in
+	}
+	if in.MaxUnavailable != nil {
+		in, out := &in.MaxUnavailable, &out.MaxUnavailable
+		*out = new(intstr.IntOrString)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodDisruptionBudgetSpec.
+func (in *PodDisruptionBudgetSpec) DeepCopy() *PodDisruptionBudgetSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(PodDisruptionBudgetSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodSpec) DeepCopyInto(out *PodSpec) {
+	*out = *in
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.NodeSelector != nil {
+		in, out := &in.NodeSelector, &out.NodeSelector
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Tolerations != nil {
+		in, out := &in.Tolerations, &out.Tolerations
+		*out = make([]corev1.Toleration, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Affinity != nil {
+		in, out := &in.Affinity, &out.Affinity
+		*out = new(corev1.Affinity)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.TopologySpreadConstraints != nil {
+		in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints
+		*out = make([]corev1.TopologySpreadConstraint, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	in.Resources.DeepCopyInto(&out.Resources)
+	if in.SecurityContext != nil {
+		in, out := &in.SecurityContext, &out.SecurityContext
+		*out = new(corev1.PodSecurityContext)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ContainerSecurityContext != nil {
+		in, out := &in.ContainerSecurityContext, &out.ContainerSecurityContext
+		*out = new(corev1.SecurityContext)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ExtraEnv != nil {
+		in, out := &in.ExtraEnv, &out.ExtraEnv
+		*out = make([]corev1.EnvVar, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.ExtraEnvFrom != nil {
+		in, out := &in.ExtraEnvFrom, &out.ExtraEnvFrom
+		*out = make([]corev1.EnvFromSource, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.ExtraVolumes != nil {
+		in, out := &in.ExtraVolumes, &out.ExtraVolumes
+		*out = make([]corev1.Volume, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.ExtraVolumeMounts != nil {
+		in, out := &in.ExtraVolumeMounts, &out.ExtraVolumeMounts
+		*out = make([]corev1.VolumeMount, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.ImagePullSecrets != nil {
+		in, out := &in.ImagePullSecrets, &out.ImagePullSecrets
+		*out = make([]corev1.LocalObjectReference, len(*in))
+		copy(*out, *in)
+	}
+	if in.DisruptionBudget != nil {
+		in, out := &in.DisruptionBudget, &out.DisruptionBudget
+		*out = new(PodDisruptionBudgetSpec)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodSpec.
+func (in *PodSpec) DeepCopy() *PodSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(PodSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *PostgresClusterRef) DeepCopyInto(out *PostgresClusterRef) {
 	*out = *in
@@ -643,6 +767,7 @@ func (in *TerdutServerSpec) DeepCopyInto(out *TerdutServerSpec) {
 	in.Notify.DeepCopyInto(&out.Notify)
 	in.OIDC.DeepCopyInto(&out.OIDC)
 	in.AllowedTeams.DeepCopyInto(&out.AllowedTeams)
+	in.Pod.DeepCopyInto(&out.Pod)
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TerdutServerSpec.

charts/terdut-operator/Chart.yaml

@@ -6,8 +6,8 @@ type: application
 # These fields decide nothing: `make helm-package` passes --version and
 # --app-version from the release tag (same reasoning as terdut-server's own
 # chart). They're for whoever reads the tree before a tag exists.
-version: 0.1.1
-appVersion: "v0.1.1"
+version: 0.2.0
+appVersion: "v0.2.0"
 
 keywords:
   - kubernetes

charts/terdut-operator/templates/rbac/manager-role.yaml

@@ -58,6 +58,18 @@ rules:
   verbs:
   - create
   - patch
+- apiGroups:
+  - policy
+  resources:
+  - poddisruptionbudgets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - terdut.ryuvia.com
   resources:

charts/terdut-operator/templates/terdutserver/terdutserver.yaml

@@ -51,4 +51,8 @@ spec:
   allowedTeams:
     {{- toYaml . | nindent 4 }}
   {{- end }}
+  {{- with .Values.terdutServer.pod }}
+  pod:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 {{- end }}

charts/terdut-operator/values.yaml

@@ -236,9 +236,12 @@ terdutServer:
   replicas: 1
 
   networking:
-    ## Required when terdutServer.enabled -- the hostname a future
-    ## HTTPRoute will carry (see NetworkingSpec's own doc comment: creating
-    ## that HTTPRoute isn't implemented yet).
+    ## Required when terdutServer.enabled -- terdut-server's own public
+    ## URL, used for absolute links it generates itself (notifications,
+    ## OIDC redirect URIs). This chart/operator never creates any
+    ## ingress/HTTPRoute for it -- see examples/networking in the repo for
+    ## how to expose the Service this chart's TerdutServer CR causes to
+    ## be created, if you want to expose it at all.
     # hostname: ""
     servicePort: 8080
 
@@ -270,3 +273,19 @@ terdutServer:
 
   # allowedTeams: {}
 
+  ## Pod-level customization of the Deployment this TerdutServer creates --
+  ## see api/v1alpha1/terdutserver_types.go's PodSpec for the full shape
+  ## (nodeSelector, tolerations, affinity, topologySpreadConstraints,
+  ## securityContext, containerSecurityContext, serviceAccountName,
+  ## extraEnv/extraEnvFrom, extraVolumes/extraVolumeMounts,
+  ## imagePullSecrets, disruptionBudget). All optional; resources is the
+  ## one most installs will want to set, since the container otherwise
+  ## runs with no requests/limits at all:
+  # pod:
+  #   resources:
+  #     requests:
+  #       cpu: 100m
+  #       memory: 128Mi
+  #     limits:
+  #       memory: 256Mi
+

config/rbac/role.yaml

@@ -52,6 +52,18 @@ rules:
   verbs:
   - create
   - patch
+- apiGroups:
+  - policy
+  resources:
+  - poddisruptionbudgets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - terdut.ryuvia.com
   resources:

config/samples/terdut_v1alpha1_terdutserver.yaml

@@ -31,3 +31,12 @@ spec:
     timeout: 15m
     severity: critical
   passwordLogin: true
+  # Pod-level customization, all optional -- see PodSpec in
+  # api/v1alpha1/terdutserver_types.go for the full shape (tolerations,
+  # affinity, topologySpreadConstraints, securityContext,
+  # serviceAccountName, extraEnv/extraVolumes, imagePullSecrets,
+  # disruptionBudget, ...). Example:
+  #   pod:
+  #     resources:
+  #       requests: {cpu: 100m, memory: 128Mi}
+  #       limits: {memory: 256Mi}

examples/demo/00-postgres.yaml

@@ -0,0 +1,96 @@
+# Demo-only Postgres: a bare Deployment+Service+Secret, not the Zalando
+# postgres-operator path (DatabaseSpec.postgresClusterRef, DESIGN.md §8).
+# Bring-your-own DSN is the simpler of the two paths to stand up from
+# nothing (ROADMAP.md Stage 1's own note), which is all this needs to be.
+#
+# emptyDir, one replica, a password sitting in a plaintext Secret below --
+# none of that is how you'd run Postgres for real. It exists only so
+# 01-server.yaml has something to talk to. Throw the whole demo namespace
+# away when you're done; nothing here is meant to survive that.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: terdut-operator-demo-postgres
+type: Opaque
+stringData:
+  password: demo-not-a-real-password
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: terdut-operator-demo-postgres
+  labels:
+    app: terdut-operator-demo-postgres
+spec:
+  replicas: 1
+  # Recreate, not RollingUpdate: emptyDir means a new pod starts with an
+  # empty database anyway, and two Postgres pods would never agree on one
+  # emptyDir each.
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: terdut-operator-demo-postgres
+  template:
+    metadata:
+      labels:
+        app: terdut-operator-demo-postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:17-alpine
+          # Partial, deliberately: the official image's entrypoint needs to
+          # start as root to chown/chmod the data directory before it drops
+          # privileges itself (gosu, to the postgres user) -- forcing
+          # runAsNonRoot would just refuse to start the container, and
+          # dropping all capabilities (an earlier version of this file did)
+          # takes CAP_CHOWN/CAP_FOWNER away from that same root user, which
+          # is a different way of breaking the identical startup step:
+          # confirmed the hard way, as `chmod: /var/run/postgresql:
+          # Operation not permitted` in a real pod's logs, not caught by
+          # `kubectl apply --dry-run=server` -- that only checks admission
+          # policy, never whether the container actually boots. A
+          # "restricted" PodSecurity namespace warns on the remaining gap
+          # (no runAsNonRoot) rather than blocking, which is an acceptable
+          # tradeoff for Postgres that exists only to be thrown away with
+          # the rest of this demo.
+          securityContext:
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
+          ports:
+            - name: postgres
+              containerPort: 5432
+          env:
+            - name: POSTGRES_USER
+              value: terdut
+            - name: POSTGRES_DB
+              value: terdut
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: terdut-operator-demo-postgres
+                  key: password
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+              subPath: pgdata
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "terdut"]
+            initialDelaySeconds: 5
+      volumes:
+        - name: data
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: terdut-operator-demo-postgres
+spec:
+  selector:
+    app: terdut-operator-demo-postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: postgres

examples/demo/01-server.yaml

@@ -0,0 +1,32 @@
+# The one TerdutServer this whole demo runs against. Everything else in
+# this directory (teams, escalation rules, dead man's switches, alert
+# sources) references it by name.
+#
+# The operator never creates any ingress/HTTPRoute for this TerdutServer --
+# that's a permanent non-goal (DESIGN.md §1, NetworkingSpec's own doc
+# comment), not a missing feature. This demo reaches it only by
+# port-forwarding its Service, same name as this object (see README.md);
+# see ../networking for worked examples of exposing it yourself instead.
+apiVersion: terdut.ryuvia.com/v1alpha1
+kind: TerdutServer
+metadata:
+  name: terdut-operator-demo
+spec:
+  image:
+    repository: git.ryuvia.com/niklas/terdut-server
+    tag: v0.33.2
+  replicas: 1
+  networking:
+    hostname: terdut-operator-demo.example
+    servicePort: 8080
+  database:
+    dsn: "postgres://terdut@terdut-operator-demo-postgres:5432/terdut?sslmode=disable"
+    passwordSecretRef:
+      name: terdut-operator-demo-postgres
+      key: password
+  sweeper:
+    staleAfter: 6h
+    archiveAfter: 168h
+  # No oidc block: password login only, so there's nothing external to
+  # register a redirect URI with before this demo can sign in.
+  passwordLogin: true

examples/demo/02-team-platform.yaml

@@ -0,0 +1,17 @@
+# Two teams (this one and 03-team-payments.yaml) so the demo shows
+# per-team isolation -- separate incident lists, separate escalation
+# ladders, separate alert sources -- rather than one team standing in for
+# everything.
+apiVersion: terdut.ryuvia.com/v1alpha1
+kind: TerdutTeam
+metadata:
+  name: terdutteam-platform
+spec:
+  # serverRef.namespace omitted: both this and terdut-operator-demo (01-server.yaml)
+  # live in whatever namespace you apply this directory into, which is the
+  # common case and needs no allowedTeams consent on the TerdutServer side
+  # (DESIGN.md §4.1, §4.6).
+  serverRef:
+    name: terdut-operator-demo
+  displayName: Platform
+  # No oidc block: this demo is password-login only (01-server.yaml).

examples/demo/03-team-payments.yaml

@@ -0,0 +1,8 @@
+apiVersion: terdut.ryuvia.com/v1alpha1
+kind: TerdutTeam
+metadata:
+  name: terdutteam-payments
+spec:
+  serverRef:
+    name: terdut-operator-demo
+  displayName: Payments

examples/demo/04-escalation-platform.yaml

@@ -0,0 +1,24 @@
+# One per team is the rule (DESIGN.md §4.3) -- a second TerdutEscalationRule
+# naming the same teamRef would just clobber this one on the next reconcile.
+apiVersion: terdut.ryuvia.com/v1alpha1
+kind: TerdutEscalationRule
+metadata:
+  name: terdutescalationrule-platform
+spec:
+  teamRef:
+    name: terdutteam-platform
+  repeatCount: 2
+  fallbackTopic: platform-fallback
+  levels:
+    # username is required iff kind is "user", rejected otherwise -- CEL
+    # validation at apply time (api/v1alpha1/terdutescalationrule_types.go).
+    # alice won't exist on a fresh demo install -- see README.md for
+    # creating a real user if you want this level to mean something, or
+    # just watch it fall through to oncall after 5m.
+    - timeout: 5m
+      targets:
+        - kind: user
+          username: alice
+    - timeout: 10m
+      targets:
+        - kind: oncall

examples/demo/05-escalation-payments.yaml

@@ -0,0 +1,13 @@
+apiVersion: terdut.ryuvia.com/v1alpha1
+kind: TerdutEscalationRule
+metadata:
+  name: terdutescalationrule-payments
+spec:
+  teamRef:
+    name: terdutteam-payments
+  repeatCount: 1
+  fallbackTopic: payments-fallback
+  levels:
+    - timeout: 5m
+      targets:
+        - kind: oncall

examples/demo/06-deadman-platform.yaml

@@ -0,0 +1,17 @@
+# A per-team dead man's switch (DESIGN.md §4.4) -- a different thing from
+# 01-server.yaml's spec.deadman, which this demo leaves unset so this CRD
+# is what you're actually seeing reconcile. fire-alerts.sh's "heartbeat"
+# scenario sends a matching alert; stop sending it and terdut-server
+# itself opens an incident once `timeout` passes with no heartbeat.
+apiVersion: terdut.ryuvia.com/v1alpha1
+kind: TerdutDeadmanSwitch
+metadata:
+  name: terdutdeadmanswitch-platform
+spec:
+  teamRef:
+    name: terdutteam-platform
+  # name omitted -- terdut-server derives one from the matcher's own
+  # canonical form (DESIGN.md §4.4).
+  matcher: "alertname=PlatformWatchdog"
+  timeout: 15m
+  severity: critical

examples/demo/07-deadman-payments.yaml

@@ -0,0 +1,10 @@
+apiVersion: terdut.ryuvia.com/v1alpha1
+kind: TerdutDeadmanSwitch
+metadata:
+  name: terdutdeadmanswitch-payments
+spec:
+  teamRef:
+    name: terdutteam-payments
+  matcher: "alertname=PaymentsWatchdog"
+  timeout: 15m
+  severity: critical

examples/demo/08-alertsource-platform.yaml

@@ -0,0 +1,18 @@
+# The webhook URL/key fire-alerts.sh sends to, for the Platform team.
+# terdut-server shows the key exactly once, at creation, and never again
+# (DESIGN.md §4.5) -- this object's status.webhookURLSecretRef names the
+# generated Secret holding it (keys "url" and "key"), which is what
+# fire-alerts.sh reads. See README.md before applying this: it's the one
+# object in this directory whose Secret you can't just re-read if you
+# miss it.
+apiVersion: terdut.ryuvia.com/v1alpha1
+kind: TerdutAlertSource
+metadata:
+  name: terdutalertsource-platform
+spec:
+  teamRef:
+    name: terdutteam-platform
+  # kind defaults to "alertmanager" -- the only value terdut-server
+  # supports today.
+  kind: alertmanager
+  name: platform-demo-alertmanager

examples/demo/09-alertsource-payments.yaml

@@ -0,0 +1,9 @@
+apiVersion: terdut.ryuvia.com/v1alpha1
+kind: TerdutAlertSource
+metadata:
+  name: terdutalertsource-payments
+spec:
+  teamRef:
+    name: terdutteam-payments
+  kind: alertmanager
+  name: payments-demo-alertmanager

examples/demo/README.md

@@ -0,0 +1,147 @@
+# Demo
+
+Every CRD this operator reconciles, wired into one working install: one
+`TerdutServer`, two `TerdutTeam`s (Platform and Payments) each with their
+own `TerdutEscalationRule`, `TerdutDeadmanSwitch` and `TerdutAlertSource`,
+plus a script that fires synthetic Alertmanager webhooks at it so you can
+watch real incidents appear, escalate and resolve.
+
+This is a demo kit, not a reference deployment: `00-postgres.yaml` runs
+Postgres with `emptyDir` storage and a password committed in this
+directory. Throw the whole namespace away when you're done.
+
+## Prerequisites
+
+- The operator and its CRDs installed and running (`make install
+  deploy IMG=...`, or `charts/terdut-operator` — see this repo's own
+  README.md/DESIGN.md), pointed at a cluster you're fine creating
+  throwaway resources in. A `kind` cluster is the easy choice.
+- `kubectl`, `jq`, `curl` on your path.
+
+**Apply this into a namespace of its own.** Every object name in this
+directory is prefixed `terdut-operator-demo` specifically so applying it
+by mistake into some other namespace that already has unrelated objects
+doesn't collide with them -- but that only helps if this directory's own
+objects don't collide with *each other* across two applies. Applying it
+twice into two different namespaces is fine; applying it a second time
+into a namespace that already has something else named `terdut-demo` (a
+real install from following `terdut-operator`'s own repo along, say) is
+exactly the mistake this prefix exists to avoid, and it only works if you
+don't override these names yourself.
+
+## Apply it
+
+```sh
+kubectl create namespace terdut-operator-demo
+kubectl apply -n terdut-operator-demo -k .
+```
+
+Listed and applied in dependency order (server → team → everything that
+`teamRef`s it), but you don't have to preserve that order yourself:
+every controller here re-queues and waits rather than failing when a ref
+isn't resolvable yet (`kubectl describe` shows `Reason: TeamRefNotFound` /
+`WaitingForTeam` while that settles).
+
+Watch it converge:
+
+```sh
+kubectl get terdutservers,terdutteams,terdutescalationrules,terdutdeadmanswitches,terdutalertsources \
+  -n terdut-operator-demo
+```
+
+The operator's own Deployment template now carries a `wait-for-postgres`
+init container (same fix as `charts/terdut-server`'s chart as of v0.33.2),
+so `terdut-operator-demo`'s pod should come up clean even against this brand-new
+Postgres doing its very first boot — no `CrashLoopBackOff` expected here.
+
+Once `terdut-operator-demo`'s own `Ready` condition is `True`, everything downstream
+of it should settle within a reconcile interval or two.
+
+## See the web UI
+
+The operator never creates any external exposure for a `TerdutServer` --
+that's a permanent non-goal (DESIGN.md §1), not a missing feature, so this
+demo just reaches it the simplest way there is:
+
+```sh
+kubectl -n terdut-operator-demo port-forward svc/terdut-operator-demo 8080:8080
+```
+
+and open http://localhost:8080. See `../networking` for worked examples of
+exposing it for real (Gateway API, Istio, or a plain `Ingress`) instead.
+
+### First login
+
+The operator's own bootstrap (DESIGN.md §6) creates the first user through
+`/api/bootstrap` and immediately mints itself a service-account token from
+it — that account has no password, so there's nothing to sign in with yet.
+`signup_mode` also defaults to `invite_only`, so open signup needs turning
+on first, using the admin token the operator generated for itself:
+
+```sh
+# Which namespace the operator itself runs in:
+kubectl get deploy -A -l control-plane=controller-manager
+
+# The Secret holding the operator's own admin token for this TerdutServer
+# (cross-namespace from terdut-operator-demo, per DESIGN.md §7):
+secretname=$(kubectl -n terdut-operator-demo get terdutserver terdut-operator-demo \
+  -o jsonpath='{.status.credentialsSecretRef.name}')
+token=$(kubectl -n <operator-namespace-from-above> get secret "$secretname" \
+  -o jsonpath='{.data.token}' | base64 -d)
+
+curl -X PUT http://localhost:8080/api/admin/settings \
+  -H "Authorization: Bearer $token" -H 'Content-Type: application/json' \
+  -d '{"signup_mode":"open"}'
+```
+
+Then sign up through the UI as a normal human account. `04-escalation-platform.yaml`
+names a user `alice` at its first escalation level — sign up as `alice` if
+you want that level to mean something rather than falling through to
+on-call after 5 minutes.
+
+## Fire some alerts
+
+In another terminal, with the port-forward above still running:
+
+```sh
+export NAMESPACE=terdut-operator-demo
+
+./fire-alerts.sh platform high-cpu
+./fire-alerts.sh platform disk-full
+./fire-alerts.sh payments pod-crash
+
+# Watch it open an incident, escalate per 04/05-escalation-*.yaml's
+# levels, and show up on the Platform/Payments team's own incident list.
+
+./fire-alerts.sh platform high-cpu resolve
+```
+
+`fire-alerts.sh -h` (or any bad argument) prints the full scenario list.
+Each `(team, scenario)` pair is one stable fingerprint, so firing the same
+one twice updates the same alert (a real re-fire) and `resolve` closes
+exactly that one.
+
+### Dead man's switches
+
+`06-deadman-platform.yaml` / `07-deadman-payments.yaml` expect a heartbeat
+alert on a 15-minute timeout:
+
+```sh
+./fire-alerts.sh platform heartbeat
+```
+
+Keep sending that (e.g. a `watch -n 60`) and nothing happens — that's the
+point. Stop sending it and, 15 minutes after the last one, terdut-server
+opens a `critical` incident on its own, with no webhook involved: proof
+the switch is watching for silence, not for a signal.
+
+## Tear down
+
+```sh
+kubectl delete namespace terdut-operator-demo
+```
+
+The operator's own finalizers clean up everything cross-namespace
+(credentials Secrets in the operator's namespace, server-side team/rule/
+integration rows) before this namespace's objects actually disappear —
+give it a few seconds past the `kubectl delete` returning.

examples/demo/fire-alerts.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+# Sends a synthetic Alertmanager v4 webhook payload at the "platform" or
+# "payments" demo team's TerdutAlertSource, so terdut-server opens (or
+# resolves) an incident exactly the way it would for a real Alertmanager.
+#
+# The payload shape here is amPayload/amAlert, read straight out of
+# terdut-server's own internal/api/alertmanager.go rather than guessed from
+# its docs -- version/status/groupKey/groupLabels, and alerts[] carrying
+# status/labels/annotations/startsAt/endsAt/generatorURL/fingerprint.
+#
+# Why this reads the webhook key out of a kubectl Secret instead of using
+# the "url" key already in it: that URL is built from spec.networking.hostname
+# (TERDUT_PUBLIC_URL), and nothing in this demo stands up real ingress for
+# it (01-server.yaml's own comment) -- so it resolves nowhere. The key
+# alone, against whatever you've actually port-forwarded BASE_URL to below,
+# is the one part of that URL still usable here.
+#
+# Usage:
+#   ./fire-alerts.sh <platform|payments> <high-cpu|disk-full|pod-crash|heartbeat> [resolve]
+#
+# Prerequisites: kubectl context pointed at the demo namespace, jq, curl,
+# and (in another terminal) a running:
+#   kubectl port-forward svc/terdut-operator-demo 8080:8080
+set -euo pipefail
+
+NAMESPACE="${NAMESPACE:-}"
+BASE_URL="${BASE_URL:-http://localhost:8080}"
+
+usage() {
+  cat >&2 <<'EOF'
+usage: fire-alerts.sh <platform|payments> <scenario> [resolve]
+
+scenarios:
+  high-cpu    warning  -- CPU usage above 90% for 10 minutes
+  disk-full   critical -- disk usage above 95%
+  pod-crash   error    -- a pod crash-looping
+  heartbeat   critical -- the team's dead man's switch heartbeat
+              (matches the matcher in 06/07-deadman-*.yaml -- send this
+              repeatedly to keep the switch alive, or stop sending it and
+              watch terdut-server open an incident on its own once
+              `timeout` passes with no heartbeat. "resolve" is not a valid
+              third argument for this scenario: a heartbeat is only ever
+              firing.)
+
+env vars:
+  NAMESPACE  kubectl -n for reading the webhook Secret (required)
+  BASE_URL   where the port-forwarded terdut-server is (default http://localhost:8080)
+EOF
+  exit 1
+}
+
+[ $# -ge 2 ] || usage
+team="$1" scenario="$2" verb="${3:-fire}"
+[ -n "$NAMESPACE" ] || { echo "fire-alerts.sh: set NAMESPACE" >&2; exit 1; }
+
+case "$team" in
+  platform|payments) ;;
+  *) usage ;;
+esac
+
+case "$scenario" in
+  high-cpu)  alertname=TerdutDemoHighCPU         severity=warning  summary="CPU usage above 90% for 10 minutes" ;;
+  disk-full) alertname=TerdutDemoDiskFull        severity=critical summary="Disk usage above 95% on /data" ;;
+  pod-crash) alertname=TerdutDemoPodCrashLooping severity=error    summary="Pod web-7f8b9 is crash-looping (5 restarts in 10m)" ;;
+  heartbeat)
+    # Must match 06-deadman-platform.yaml / 07-deadman-payments.yaml's own
+    # matcher exactly -- that's what makes this a heartbeat rather than a
+    # third ordinary alert.
+    case "$team" in
+      platform) alertname=PlatformWatchdog ;;
+      payments) alertname=PaymentsWatchdog ;;
+    esac
+    severity=critical summary="demo heartbeat"
+    [ "$verb" = fire ] || { echo "fire-alerts.sh: heartbeat is only ever fired, never resolved -- just stop sending it" >&2; exit 1; }
+    ;;
+  *) usage ;;
+esac
+
+case "$verb" in
+  fire)    status=firing ;;
+  resolve) status=resolved ;;
+  *) usage ;;
+esac
+
+secret_name="terdutalertsource-${team}-terdut-webhook"
+key="$(kubectl -n "$NAMESPACE" get secret "$secret_name" -o jsonpath='{.data.key}' | base64 -d)"
+[ -n "$key" ] || { echo "fire-alerts.sh: empty key read from Secret $secret_name -- has 08/09-alertsource-*.yaml reconciled yet?" >&2; exit 1; }
+
+# Stable per (team, scenario) so a resolve targets the same alert a fire
+# created: terdut-server correlates on (team_id, fingerprint), not on
+# anything else in the payload. Real Alertmanager computes this from the
+# alert's label set; a fixed string plays the same role here.
+fingerprint="demo-${team}-${scenario}"
+
+now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+if [ "$status" = firing ]; then
+  ends_at="0001-01-01T00:00:00Z" # Alertmanager's own "not resolved" zero value
+else
+  ends_at="$now"
+fi
+
+payload="$(jq -n \
+  --arg status "$status" \
+  --arg groupKey "demo:${team}:${scenario}" \
+  --arg alertname "$alertname" \
+  --arg team "$team" \
+  --arg severity "$severity" \
+  --arg summary "$summary" \
+  --arg startsAt "$now" \
+  --arg endsAt "$ends_at" \
+  --arg fingerprint "$fingerprint" \
+  '{
+    version: "4",
+    status: $status,
+    groupKey: $groupKey,
+    groupLabels: { alertname: $alertname, team: $team },
+    alerts: [{
+      status: $status,
+      labels: { alertname: $alertname, severity: $severity, team: $team, instance: "demo" },
+      annotations: { summary: $summary },
+      startsAt: $startsAt,
+      endsAt: $endsAt,
+      generatorURL: "https://example.com/demo",
+      fingerprint: $fingerprint
+    }]
+  }')"
+
+url="${BASE_URL}/api/integrations/${key}/alertmanager"
+echo "POST $url  (team=$team scenario=$scenario status=$status)" >&2
+code="$(curl -sS -o /tmp/fire-alerts-response.json -w '%{http_code}' \
+  -X POST "$url" -H 'Content-Type: application/json' -d "$payload")"
+echo "-> HTTP $code" >&2
+cat /tmp/fire-alerts-response.json >&2
+echo >&2
+
+if [ "$code" != "200" ]; then
+  exit 1
+fi

examples/demo/kustomization.yaml

@@ -0,0 +1,17 @@
+## kubectl apply -n <your-demo-namespace> -k examples/demo
+##
+## Listed in apply order even though kustomize itself doesn't need that --
+## a human reading this file top-to-bottom should see the same dependency
+## order the controllers themselves require (server before team, team
+## before everything that teamRefs it).
+resources:
+  - 00-postgres.yaml
+  - 01-server.yaml
+  - 02-team-platform.yaml
+  - 03-team-payments.yaml
+  - 04-escalation-platform.yaml
+  - 05-escalation-payments.yaml
+  - 06-deadman-platform.yaml
+  - 07-deadman-payments.yaml
+  - 08-alertsource-platform.yaml
+  - 09-alertsource-payments.yaml

examples/networking/README.md

@@ -0,0 +1,31 @@
+# Exposing a TerdutServer
+
+This operator never manages external exposure/ingress for `TerdutServer`,
+in any form — a permanent non-goal (`DESIGN.md` §1), not a missing
+feature. Some installs won't expose it outside the cluster at all (see
+`examples/demo`, which just port-forwards); others will put it behind
+whatever their cluster already uses. That choice is entirely yours, not
+the operator's.
+
+The only contract the operator gives you to build on: a plain `ClusterIP`
+Service, named after the `TerdutServer` CR (same name, same namespace),
+with a port named `http` (`spec.networking.servicePort`, default `8080`).
+Everything here targets exactly that Service — none of it is applied by
+`examples/demo`'s `kustomization.yaml`, and none of it depends on anything
+the operator creates beyond that one Service.
+
+Pick whichever matches your cluster:
+
+- **`httproute.yaml`** — a [Gateway API](https://gateway-api.sigs.k8s.io/)
+  `HTTPRoute`, attached to a `Gateway` you already have.
+- **`istio-virtualservice.yaml`** — an Istio `VirtualService`, attached to
+  a `Gateway` (Istio's own CRD, not Gateway API's) you already have.
+- **A plain `Ingress`** needs no example here — it's the same idea with
+  one fewer layer of indirection: an `Ingress` with a single rule whose
+  `backend.service.name`/`port.name` point at the `TerdutServer`'s Service
+  and `http` port.
+
+Remember to set `spec.networking.hostname` on the `TerdutServer` itself to
+whatever hostname you expose it on — that's not read by the operator for
+any of this, but terdut-server uses it for its own absolute links
+(notifications, OIDC redirect URIs).

examples/networking/httproute.yaml

@@ -0,0 +1,21 @@
+# Gateway API HTTPRoute exposing a TerdutServer through a Gateway you
+# already have (not something this operator creates or watches -- see
+# ../networking/README.md). Replace terdut-operator-demo and the Gateway
+# reference/hostname with your own; terdut-operator-demo matches
+# ../demo/01-server.yaml, if you're layering this onto that demo.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: terdut-operator-demo
+  namespace: terdut-operator-demo
+spec:
+  parentRefs:
+    - name: my-gateway          # an existing Gateway in this namespace (or
+      # namespace: gateway-ns   # a different one, if the Gateway allows it)
+      sectionName: https        # the listener to attach to, if it's picky
+  hostnames:
+    - terdut-operator-demo.example   # matches networking.hostname on the CR
+  rules:
+    - backendRefs:
+        - name: terdut-operator-demo  # the Service the operator created --
+          port: 8080                  # same name as the TerdutServer CR

examples/networking/istio-virtualservice.yaml

@@ -0,0 +1,23 @@
+# Istio VirtualService exposing a TerdutServer through an Istio Gateway
+# you already have (Istio's own Gateway CRD, not Gateway API's -- not
+# something this operator creates or watches, see ../networking/README.md).
+# Replace terdut-operator-demo and the gateway reference/hostname with your
+# own; terdut-operator-demo matches ../demo/01-server.yaml, if you're
+# layering this onto that demo.
+apiVersion: networking.istio.io/v1
+kind: VirtualService
+metadata:
+  name: terdut-operator-demo
+  namespace: terdut-operator-demo
+spec:
+  hosts:
+    - terdut-operator-demo.example   # matches networking.hostname on the CR
+  gateways:
+    - my-gateway-namespace/my-gateway   # an existing istio Gateway
+  http:
+    - route:
+        - destination:
+            host: terdut-operator-demo.terdut-operator-demo.svc.cluster.local
+            port:
+              number: 8080   # the Service's port -- same name as the
+                              # TerdutServer CR, default servicePort

go.mod

@@ -25,7 +25,7 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v1.0.0 // indirect
@@ -64,13 +64,13 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
-	go.opentelemetry.io/otel v1.44.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 // indirect
-	go.opentelemetry.io/otel/metric v1.44.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.44.0 // indirect
-	go.opentelemetry.io/otel/trace v1.44.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
+	go.opentelemetry.io/otel v1.45.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.45.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.1 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
@@ -86,8 +86,8 @@ require (
 	golang.org/x/time v0.15.0 // indirect
 	golang.org/x/tools v0.48.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
 	google.golang.org/grpc v1.83.2 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect

go.sum

@@ -36,8 +36,8 @@ github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6O
 github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE=
 github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
@@ -168,22 +168,22 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
-go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
-go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 h1:4YsVu3B8+3qtWYYrsUYgn0OG78pN0rnNPRGX4SbokQI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0/go.mod h1:+wnlSn0mD1ADVMe3v9Z/WIaiz6q6gL2J/ejaAmdmv80=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 h1:qazEJlUOQzhCpzQpFETGby7EdqjI1wsd0W+6Gg1SCTU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0/go.mod h1:fOD2Yefuxixkx3ahVNf0O/PERb6r4OlbxfATVnYvzCo=
-go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
-go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
-go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
-go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
-go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
-go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
-go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
-go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
-go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
-go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 h1:QRefszxJmfPdjXUUm3j6iDzY03mTPXMjqErFqQ67vUg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0/go.mod h1:Tiz03lTBVBrm7eWZBOidzEaYaJa8tjwGUGv6d8mlTyk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 h1:fG5MCxGz8+2VtrN/WgqSpJFctVz24gpxj8CxkKmc8Ww=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0/go.mod h1:BmAYTn+3ysbRe+IU2msxmf5Rx3g6DHvex+tWI3LdhYI=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
+go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
+go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
+go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
+go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -218,10 +218,10 @@ gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8=
-google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d h1:FarXi840EJWSHYTN3ERkADbPWjl307+FGrA22KAVjjc=
+google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d/go.mod h1:K/+WGbmBY7aNW1HDw1fJnKYo10i0DkAX6pows00dLig=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1:IL4hdHzcUv2l/gcg98/Rj3FbtE6axwqslOW8SW0C+S0=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
 google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=

internal/controller/terdutserver_controller.go

@@ -8,6 +8,7 @@ import (
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+	policyv1 "k8s.io/api/policy/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -97,6 +98,7 @@ type TerdutServerReconciler struct {
 // +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=policy,resources=poddisruptionbudgets,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=acid.zalan.do,resources=postgresqls,verbs=get;list;watch
 // +kubebuilder:rbac:groups=events.k8s.io,resources=events,verbs=create;patch
 
@@ -137,6 +139,9 @@ func (r *TerdutServerReconciler) Reconcile(ctx context.Context, req ctrl.Request
 	if err := r.reconcileService(ctx, &srv); err != nil {
 		return ctrl.Result{}, err
 	}
+	if err := r.reconcilePodDisruptionBudget(ctx, &srv); err != nil {
+		return ctrl.Result{}, err
+	}
 
 	meta.SetStatusCondition(&srv.Status.Conditions, metav1.Condition{
 		Type:    terdutv1alpha1.ConditionDatabaseReady,
@@ -246,6 +251,7 @@ func (r *TerdutServerReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		For(&terdutv1alpha1.TerdutServer{}).
 		Owns(&appsv1.Deployment{}).
 		Owns(&corev1.Service{}).
+		Owns(&policyv1.PodDisruptionBudget{}).
 		Named("terdutserver").
 		Complete(r)
 }

internal/controller/terdutserver_controller_test.go

@@ -14,10 +14,14 @@ import (
 	. "github.com/onsi/gomega"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+	policyv1 "k8s.io/api/policy/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/intstr"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
@@ -705,6 +709,95 @@ var _ = Describe("TerdutServer Controller", func() {
 		})
 	})
 
+	Describe("spec.pod", func() {
+		It("wires pod-level customization onto the right spot on the Deployment", func(ctx SpecContext) {
+			fake, fakeSrv := newFakeTerdutServer()
+			_ = fake
+			DeferCleanup(fakeSrv.Close)
+			reconciler.NewClient = func(string) *tdclient.Client { return tdclient.New(fakeSrv.URL) }
+
+			spec := dsnSpec()
+			qty := resource.MustParse("250m")
+			spec.Pod = terdutv1alpha1.PodSpec{
+				Resources:          corev1.ResourceRequirements{Requests: corev1.ResourceList{corev1.ResourceCPU: qty}},
+				Tolerations:        []corev1.Toleration{{Key: "dedicated", Operator: corev1.TolerationOpEqual, Value: "terdut", Effect: corev1.TaintEffectNoSchedule}},
+				ExtraEnv:           []corev1.EnvVar{{Name: "EXTRA_FLAG", Value: "on"}},
+				ServiceAccountName: "terdut-server-custom",
+				ExtraVolumes:       []corev1.Volume{{Name: "extra-ca", VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{}}}},
+				ExtraVolumeMounts:  []corev1.VolumeMount{{Name: "extra-ca", MountPath: "/etc/extra-ca"}},
+			}
+			createServer(ctx, spec)
+			reconcileOnce(ctx) // finalizer
+			reconcileOnce(ctx) // Deployment/Service/PDB
+
+			var deploy appsv1.Deployment
+			Expect(k8sClient.Get(ctx, objKey, &deploy)).To(Succeed())
+
+			podSpec := deploy.Spec.Template.Spec
+			Expect(podSpec.Tolerations).To(ConsistOf(spec.Pod.Tolerations))
+			Expect(podSpec.ServiceAccountName).To(Equal("terdut-server-custom"))
+			Expect(podSpec.Volumes).To(ConsistOf(spec.Pod.ExtraVolumes))
+
+			main := podSpec.Containers[0]
+			Expect(main.Name).To(Equal("terdut-server"))
+			Expect(main.Resources).To(Equal(spec.Pod.Resources))
+			Expect(main.VolumeMounts).To(ConsistOf(spec.Pod.ExtraVolumeMounts))
+			Expect(main.Env).To(ContainElement(corev1.EnvVar{Name: "EXTRA_FLAG", Value: "on"}))
+
+			initContainer := podSpec.InitContainers[0]
+			Expect(initContainer.Name).To(Equal("wait-for-postgres"))
+			Expect(initContainer.VolumeMounts).To(BeEmpty(), "extraVolumeMounts must not leak onto wait-for-postgres")
+		})
+	})
+
+	Describe("spec.pod.disruptionBudget", func() {
+		It("creates an owned PodDisruptionBudget when set, and deletes it once cleared", func(ctx SpecContext) {
+			fake, fakeSrv := newFakeTerdutServer()
+			_ = fake
+			DeferCleanup(fakeSrv.Close)
+			reconciler.NewClient = func(string) *tdclient.Client { return tdclient.New(fakeSrv.URL) }
+
+			spec := dsnSpec()
+			minAvail := intstr.FromInt32(1)
+			spec.Pod.DisruptionBudget = &terdutv1alpha1.PodDisruptionBudgetSpec{MinAvailable: &minAvail}
+			createServer(ctx, spec)
+			reconcileOnce(ctx) // finalizer
+			reconcileOnce(ctx) // Deployment/Service/PDB
+
+			var pdb policyv1.PodDisruptionBudget
+			Expect(k8sClient.Get(ctx, objKey, &pdb)).To(Succeed())
+			Expect(pdb.Spec.Selector.MatchLabels).To(Equal(labelsFor(&terdutv1alpha1.TerdutServer{ObjectMeta: metav1.ObjectMeta{Name: name}})))
+			Expect(pdb.Spec.MinAvailable).To(Equal(&minAvail))
+			Expect(pdb.OwnerReferences).To(ContainElement(HaveField("Name", name)))
+
+			srv := &terdutv1alpha1.TerdutServer{}
+			Expect(k8sClient.Get(ctx, objKey, srv)).To(Succeed())
+			srv.Spec.Pod.DisruptionBudget = nil
+			Expect(k8sClient.Update(ctx, srv)).To(Succeed())
+			reconcileOnce(ctx)
+
+			err := k8sClient.Get(ctx, objKey, &policyv1.PodDisruptionBudget{})
+			Expect(apierrors.IsNotFound(err)).To(BeTrue(), "PodDisruptionBudget should be deleted once spec.pod.disruptionBudget is cleared")
+		})
+
+		It("rejects both minAvailable and maxUnavailable set together, and neither set", func(ctx SpecContext) {
+			bothSet := dsnSpec()
+			minAvail, maxUnavail := intstr.FromInt32(1), intstr.FromInt32(1)
+			bothSet.Pod.DisruptionBudget = &terdutv1alpha1.PodDisruptionBudgetSpec{MinAvailable: &minAvail, MaxUnavailable: &maxUnavail}
+			Expect(k8sClient.Create(ctx, &terdutv1alpha1.TerdutServer{
+				ObjectMeta: metav1.ObjectMeta{Name: name + "-both", Namespace: operatorNamespace},
+				Spec:       bothSet,
+			})).To(HaveOccurred())
+
+			neitherSet := dsnSpec()
+			neitherSet.Pod.DisruptionBudget = &terdutv1alpha1.PodDisruptionBudgetSpec{}
+			Expect(k8sClient.Create(ctx, &terdutv1alpha1.TerdutServer{
+				ObjectMeta: metav1.ObjectMeta{Name: name + "-neither", Namespace: operatorNamespace},
+				Spec:       neitherSet,
+			})).To(HaveOccurred())
+		})
+	})
+
 	Describe("deletion", func() {
 		It("removes the credentials and checkpoint Secrets and the finalizer", func(ctx SpecContext) {
 			fake, fakeSrv := newFakeTerdutServer()

internal/controller/terdutserver_deployment.go

@@ -48,10 +48,26 @@ func (r *TerdutServerReconciler) reconcileDeployment(
 		// overlapping during a rollout would both page for the same
 		// incident (matches the chart's own deployment.yaml comment).
 		deploy.Spec.Strategy = appsv1.DeploymentStrategy{Type: appsv1.RecreateDeploymentStrategyType}
+		pod := srv.Spec.Pod
 		deploy.Spec.Template = corev1.PodTemplateSpec{
-			ObjectMeta: metav1.ObjectMeta{Labels: labels},
+			// pod.Annotations is assigned directly, not merged -- nothing
+			// else sets pod-template annotations today. If a future change
+			// needs the controller to set one of its own (e.g. a
+			// Prometheus-scrape annotation), this needs to become a real
+			// map merge with a stated precedence rather than silently
+			// clobbering one side.
+			ObjectMeta: metav1.ObjectMeta{Labels: labels, Annotations: pod.Annotations},
 			Spec: corev1.PodSpec{
-				EnableServiceLinks: new(false),
+				EnableServiceLinks:        new(false),
+				NodeSelector:              pod.NodeSelector,
+				Tolerations:               pod.Tolerations,
+				Affinity:                  pod.Affinity,
+				TopologySpreadConstraints: pod.TopologySpreadConstraints,
+				SecurityContext:           pod.SecurityContext,
+				ServiceAccountName:        pod.ServiceAccountName,
+				ImagePullSecrets:          pod.ImagePullSecrets,
+				InitContainers:            []corev1.Container{waitForPostgresContainer(dbEnv)},
+				Volumes:                   pod.ExtraVolumes,
 				Containers: []corev1.Container{{
 					Name:  "terdut-server",
 					Image: fmt.Sprintf("%s:%s", srv.Spec.Image.Repository, srv.Spec.Image.Tag),
@@ -60,9 +76,13 @@ func (r *TerdutServerReconciler) reconcileDeployment(
 						ContainerPort: servicePort(srv),
 						Protocol:      corev1.ProtocolTCP,
 					}},
-					Env:            buildEnv(srv, dbEnv),
-					LivenessProbe:  healthzProbe(),
-					ReadinessProbe: healthzProbe(),
+					Env:             buildEnv(srv, dbEnv),
+					EnvFrom:         pod.ExtraEnvFrom,
+					VolumeMounts:    pod.ExtraVolumeMounts,
+					Resources:       pod.Resources,
+					SecurityContext: pod.ContainerSecurityContext,
+					LivenessProbe:   healthzProbe(),
+					ReadinessProbe:  healthzProbe(),
 				}},
 			},
 		}
@@ -104,6 +124,36 @@ func servicePort(srv *terdutv1alpha1.TerdutServer) int32 {
 	return srv.Spec.Networking.ServicePort
 }
 
+// waitForPostgresContainer blocks the main container from starting until
+// Postgres accepts connections, matching charts/terdut-server's own
+// deployment.yaml template as of v0.33.2 (that repo's CLAUDE.md/release
+// notes) -- that chart grew this the moment this exact Deployment, created
+// by this controller, crash-looped a few times against a from-scratch
+// postgres-operator cluster still doing initdb and Patroni leader election:
+// terdut-server's own ping-retry budget on startup (internal/db/db.go) is
+// sized for a much shorter, different race (NetworkPolicy propagation, a
+// few seconds), not for genuine first-time cluster creation, so it
+// exhausted and the process exited before ever binding its HTTP port -- a
+// startupProbe cannot help there, since the crash happens before there is
+// anything to probe.
+//
+// Reuses dbEnv unchanged: both of resolveDatabaseEnv's paths put
+// TERDUT_DB_DSN first (terdutserver_database.go), so it's already exactly
+// what pg_isready needs, and pg_isready needs no credentials -- it reports
+// PQPING_OK on anything that amounts to a Postgres backend answering,
+// including an auth challenge -- so including dbEnv's optional PGPASSWORD
+// here too is harmless rather than load-bearing.
+func waitForPostgresContainer(dbEnv []corev1.EnvVar) corev1.Container {
+	return corev1.Container{
+		Name:  "wait-for-postgres",
+		Image: "postgres:17-alpine",
+		Env:   dbEnv,
+		Command: []string{"sh", "-c",
+			`until pg_isready -d "$TERDUT_DB_DSN"; do echo "wait-for-postgres: not ready yet, retrying in 2s"; sleep 2; done`,
+		},
+	}
+}
+
 func healthzProbe() *corev1.Probe {
 	return &corev1.Probe{
 		ProbeHandler: corev1.ProbeHandler{
@@ -120,7 +170,10 @@ func healthzProbe() *corev1.Probe {
 // field-for-field (confirmed against that source, not reconstructed from
 // DESIGN.md's illustrative YAML alone) — dbEnv (TERDUT_DB_DSN, optionally
 // PGPASSWORD) comes from resolveDatabaseEnv, since which of §8's two paths
-// produced it doesn't matter past this point.
+// produced it doesn't matter past this point. spec.pod.extraEnv is appended
+// last, after every fixed var -- this is the one place that owns "what env
+// this container gets," so the escape hatch lives here rather than being
+// appended separately in reconcileDeployment.
 func buildEnv(srv *terdutv1alpha1.TerdutServer, dbEnv []corev1.EnvVar) []corev1.EnvVar {
 	env := []corev1.EnvVar{{Name: "TERDUT_ADDR", Value: fmt.Sprintf(":%d", servicePort(srv))}}
 	env = append(env, dbEnv...)
@@ -199,7 +252,7 @@ func buildEnv(srv *terdutv1alpha1.TerdutServer, dbEnv []corev1.EnvVar) []corev1.
 		}
 	}
 
-	return env
+	return append(env, srv.Spec.Pod.ExtraEnv...)
 }
 
 func secretEnvSource(ref *terdutv1alpha1.SecretKeyRef) *corev1.EnvVarSource {

internal/controller/terdutserver_pdb.go

@@ -0,0 +1,38 @@
+package controller
+
+import (
+	"context"
+
+	policyv1 "k8s.io/api/policy/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	terdutv1alpha1 "git.ryuvia.com/niklas/terdut-operator/api/v1alpha1"
+)
+
+// reconcilePodDisruptionBudget creates/updates the PodDisruptionBudget
+// spec.pod.disruptionBudget asks for, or deletes a previously-created one
+// when the field has been cleared -- the one conditionally-created child
+// object in this controller (Deployment/Service are unconditional). Owned
+// by srv, same plain-OwnerReference shape as Deployment/Service (DESIGN.md
+// §7): same namespace, GC handles it, no finalizer needed.
+func (r *TerdutServerReconciler) reconcilePodDisruptionBudget(ctx context.Context, srv *terdutv1alpha1.TerdutServer) error {
+	pdb := &policyv1.PodDisruptionBudget{ObjectMeta: metav1.ObjectMeta{Name: srv.Name, Namespace: srv.Namespace}}
+
+	spec := srv.Spec.Pod.DisruptionBudget
+	if spec == nil {
+		if err := r.Delete(ctx, pdb); err != nil && !apierrors.IsNotFound(err) {
+			return err
+		}
+		return nil
+	}
+
+	_, err := controllerutil.CreateOrUpdate(ctx, r.Client, pdb, func() error {
+		pdb.Spec.Selector = &metav1.LabelSelector{MatchLabels: labelsFor(srv)}
+		pdb.Spec.MinAvailable = spec.MinAvailable
+		pdb.Spec.MaxUnavailable = spec.MaxUnavailable
+		return controllerutil.SetControllerReference(srv, pdb, r.Scheme)
+	})
+	return err
+}