Warn at startup when installed CRDs are stale or missing

The operator strict-decodes CR specs, so when the in-cluster CRDs lag the
running operator (e.g. CRDs pinned to v0.1.0 while the operator ran v0.3.0),
new spec fields fail to decode with no operator-side signal. This adds an
advisory startup check so the mismatch is visible in the operator logs.

- Add CheckCRDVersions: GET each owned CRD and verify it carries a
  version-sentinel spec field, logging a distinct WARNING per problem
  (missing CRD vs. present-but-stale schema); advisory only, never exits.
- Keep the sentinel list (buckets/managePolicy, objectstoreusers/
  retainOnDelete, bucketaccesses/rawStatements) in one place.
- Wire the check into operator startup after the manager config is available.
- Add apiextensions customresourcedefinitions get;list RBAC marker and
  regenerate config/rbac/role.yaml.
- Promote k8s.io/apiextensions-apiserver to a direct dependency.

Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM

internal/controller/crdcheck.go

@@ -0,0 +1,89 @@
+package controller
+
+import (
+	"context"
+
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	apiextensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/rest"
+	ctrl "sigs.k8s.io/controller-runtime"
+)
+
+// The CRD version check reads CustomResourceDefinitions to compare the
+// installed schema against what this operator expects.
+//
+// +kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get;list
+
+// crdSentinel names a CRD and a spec property that only exists in the schema
+// version shipped alongside this operator build. If the installed CRD lacks the
+// sentinel, its schema predates this operator and strict decoding of new spec
+// fields will silently fail. Keep this list in one place so new fields are easy
+// to register as sentinels.
+type crdSentinel struct {
+	// crd is the metadata.name of the CustomResourceDefinition.
+	crd string
+	// specProperty is a key expected under
+	// .spec.versions[].schema.openAPIV3Schema.properties.spec.properties.
+	specProperty string
+}
+
+// crdSentinels is the authoritative list checked at startup. Extend it whenever
+// a new spec field is added that older CRDs would reject.
+var crdSentinels = []crdSentinel{
+	{crd: "buckets.ceph.unkin.net", specProperty: "managePolicy"},
+	{crd: "objectstoreusers.ceph.unkin.net", specProperty: "retainOnDelete"},
+	{crd: "bucketaccesses.ceph.unkin.net", specProperty: "rawStatements"},
+}
+
+// CheckCRDVersions verifies that every CRD this operator owns is installed and
+// carries the schema fields this build expects. It is advisory only: it logs a
+// distinct WARNING per problem and never returns an error or exits, so a stale
+// or missing CRD cannot block startup.
+func CheckCRDVersions(ctx context.Context, cfg *rest.Config) {
+	log := ctrl.Log.WithName("crd-version-check")
+
+	client, err := apiextensionsclient.NewForConfig(cfg)
+	if err != nil {
+		log.Error(err, "unable to build apiextensions client; skipping CRD version check")
+		return
+	}
+
+	for _, s := range crdSentinels {
+		crd, err := client.ApiextensionsV1().CustomResourceDefinitions().Get(ctx, s.crd, metav1.GetOptions{})
+		if apierrors.IsNotFound(err) {
+			log.Info("WARNING: CRD is not installed — apply the CRDs matching this operator version",
+				"crd", s.crd)
+			continue
+		}
+		if err != nil {
+			log.Error(err, "unable to read CRD; cannot verify it matches this operator version",
+				"crd", s.crd)
+			continue
+		}
+		if !crdHasSpecProperty(crd, s.specProperty) {
+			log.Info("WARNING: CRD is out of date — apply the CRDs matching this operator version",
+				"crd", s.crd, "missingField", "spec."+s.specProperty)
+		}
+	}
+}
+
+// crdHasSpecProperty reports whether any served/stored version of the CRD
+// declares the given property under spec.
+func crdHasSpecProperty(crd *apiextensionsv1.CustomResourceDefinition, property string) bool {
+	for _, v := range crd.Spec.Versions {
+		schema := v.Schema
+		if schema == nil || schema.OpenAPIV3Schema == nil {
+			continue
+		}
+		specSchema, ok := schema.OpenAPIV3Schema.Properties["spec"]
+		if !ok {
+			continue
+		}
+		if _, ok := specSchema.Properties[property]; ok {
+			return true
+		}
+	}
+	return false
+}