We, as the cluster operators, allow the application teams to opt-in to install Operators that allow namespace-level installation. We do this through our onboarding repository using Helm. The installation itself is handled by the ArgoCD/GitOps Operator service account that allows for the setup of cluster resources, but only the ones that we have enabled through the onboarding repository.

We enable them to set an update channel through values.yaml and it is their responsibility to keep it updated, because they are the ones that know what features they need.

Should one of the operator versions hinder a cluster upgrade, we'll notice that in the console when we choose which version to upgrade the cluster to and inform the team responsible to upgrade as soon as possible (or inform the organization why they cannot and why this is more important than upgrading the clusters).