For platform engineering teams with large scale environments, how are you managing operators in your environment? I have some questions.

I'm not talking about the people supporting 2 or 3 clusters where they are very closely aligned with the application teams (or may even be part of the application team). I'm talking about large scale environments where cluster management is separated from application management. Let's say you're managing at least 20 clusters and have more than 100 users consuming your K8s clusters.

We face an ongoing issue at my company. We manage around 400 clusters with thousands of namespaces and hundreds of users who only have namespace access. Most of our internal development teams can use the tools we've provided and if there is enough interest in a particular tech, we may include it. But, quite often we get asked to take on more and more operators (of course while major corp continues to shrink the team and grow expectations).

How are you managing operators and cluster-scoped access?

1. Do your application teams have access to deploy cluster scoped resources like CRDs, validating/mutating webhook configurations, cluster roles, cluster role bindings and the like? Or do they have to come to the platform engineering team to handle that for them?
2. If they don't have access, who supports the operator? Who supports the thing that the operator creates?
3. If they need to come to you, do you accept every operator that they want to use? Let's say you have a team that wants to use the same DB type, but each wants a different operator. Do you accept both or choose one?
4. How do you deal with multi-tenancy issues? Let's say 2 teams want the same operator, but need different versions on the same cluster. Do you just go with the latest version?
5. How do you choose which ones you'll support or not?