[ilya-lesikov]

Summary

Finish the README so a new user can install and use nelm-operator, including how to install it next to an existing Flux, the minimum Flux version, and safe Argo CD resource tracking.

What

• Requirements: Flux 2.6 or newer for an existing source-controller. The operator always watches OCIRepository through source.toolkit.fluxcd.io/v1, which Flux added in 2.6.
• Install: lists the charts and how to detect an existing source-controller, then gives separate paths for a cluster without Flux and one with Flux. The Flux path carries a prominent warning against installFluxSourceController=true, explaining what happens otherwise: a second controller reconciles the same objects, and Nelm applies the chart's Flux CRDs over the existing ones. It also gives a command to check the Flux version.
• Reaching Flux's source-controller: Flux's default allow-egress NetworkPolicy blocks artifact downloads from other namespaces. This section adds a NetworkPolicy that lets the operator's namespace in.
• Helm: install commands for both paths, and CRD upgrades with --server-side --force-conflicts for the Release CRD and for the bundled Flux CRDs.
• Uninstall: delete Releases first because of the finalizer, then use the command for your install method. Covers which methods leave CRDs behind.
• Managing Releases with Argo CD: explains the app.kubernetes.io/instance conflict under label tracking. The safe options are annotation tracking or a separate application.instanceLabelKey, followed by a re-sync. ApplyOutOfSyncOnly needs special handling.
• Configuration: lists the chart values that map to flags (maxConcurrentReconciles, defaultServiceAccount) and notes that the charts do not expose other flags. Also notes that the watches stay on Flux's v1 API whatever --source-api-* says.
• Smaller fixes: a column-aligned kubectl get release example, kubectl explain release.spec, and what make test-e2e actually does.

Why

The old README covered neither the Flux coexistence risks, the Flux version floor, nor Argo CD, and it missed the NetworkPolicy needed next to a default Flux install.

Verified on a throwaway kind cluster:

• Flux path: Flux source-controller v1.8.5 with Flux's allow-egress policy, plus the nelm-controller chart. Artifact downloads were blocked until the README's NetworkPolicy was applied verbatim, after which the podinfo Release became Ready.
• No-Flux path (Nelm CLI): install, the README's podinfo example, re-run as an upgrade, and uninstall all worked.
• Helm CRD upgrade commands: ran successfully.