Potential issues

- Operator lacks rolling upgrade strategy, risking downtime during updates
- Registry manifest missing anti-affinity, risking pod co-location on the same node
- PVC for registry defaults to single-node access mode (RWO); multi-node requires RWX or object storage
- imagePullPolicy default not set explicitly, can lead to caching issues
- status updates override conditions without merging, potentially losing state transitions
- Registry secret is reused across namespaces but not owned, causing possible orphaned secrets
- ensureRegistryPullSecret does not set owner reference, leading to resource leaks (not fatal)
- RBAC grants creation rights for secrets but not deletion; creates cluster-wide management imbalance
- Ingress reconciliation lacks TLS or hostname fallback, causing wildcard host conflicts
- Default ingress annotation for rewrite-target may be unsuitable in some contexts
- Registry deployment uses a single replica; multi-node clusters might require service type adjustments
- LoadBalancer service usage (e.g., MetalLB) needs verification for environment compatibility and defaults