refactor: Extract apply and update status steps

CHANGELOG.md

@@ -14,6 +14,8 @@ All notable changes to this project will be documented in this file.
 - BREAKING: The `brokers` role is now required by the CRD; a KafkaCluster without it was
   previously accepted by the API server but failed reconciliation ([#990]).
 - All product containers now run with `securityContext.runAsNonRoot` set to `true` to improve security ([#998]).
+- The reconciler now applies resources and derives the cluster status in discrete
+  apply and update_status steps ([#1000]).
 
 ### Fixed
 
@@ -25,6 +27,7 @@ All notable changes to this project will be documented in this file.
 [#990]: https://github.com/stackabletech/kafka-operator/pull/990
 [#994]: https://github.com/stackabletech/kafka-operator/pull/994
 [#998]: https://github.com/stackabletech/kafka-operator/pull/998
+[#1000]: https://github.com/stackabletech/kafka-operator/pull/1000
 
 ## [26.7.0] - 2026-07-21
 

deploy/helm/kafka-operator/templates/clusterrole-operator.yaml

@@ -121,7 +121,9 @@ rules:
       - authenticationclasses
     verbs:
       - get
-  # Listener created per role group. Applied via SSA and tracked for orphan cleanup.
+  # Listener created per broker role group. Applied via SSA and tracked for orphan cleanup.
+  # Fetched and watched by the controller, so a reconciliation is triggered once the
+  # listener-operator writes the ingress addresses (needed for the discovery ConfigMap).
   - apiGroups:
       - listeners.stackable.tech
     resources: