The CRD and the ClusterRole rules land with the controller change, so Flux applies them at merge, before the new kuma-sync image is built and rolled out by the ImagePolicy; the new controller watches KumaStatusPage and would not start without them. - infrastructure/kuma-sync-crds: crd-kumastatuspages.yaml, a copy of config/crd with prune disabled, next to crd-kumamonitors.yaml. - apps/kuma-sync/rbac.yaml: kumastatuspages, /status, /finalizers, as in config/rbac/role.yaml. - apps/kuma-sync/statuspage-renner.yaml: the public page (slug renner, domain uptime.renner.uno) with the sections Services and Third-party, selected by the uptime.renner.uno/status-page-section label. - The label on the 17 top-level service groups and the four third-party HTTP checks. An envtest test validates the deployed page object against the CRD. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>