Library staff try kubectl get on a custom resource and fail until the matching CRD is installed. What rule explains that behavior?

Library staff fail kubectl get on a custom resource until the matching CRD is installed because CR instances require the API extension to exist before the API serves that kind. You cannot file a special permit before city hall adds the form to the catalog—install the CRD first. Custom resources are not stored only on worker local disk until CNI is ready as the reason kubectl get fails. kubectl cannot invent arbitrary kinds without CRDs merely via impersonation. Operators do not delete CRDs automatically before any custom resource may be created as a prerequisite rule. Exam caveat: Install order: CRDs before (or with) sample CRs and controllers. Operational check: Apply CRDs first, verify api-resources, then apply CRs; document order in the library operator runbook. In municipal platform operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the cluster’s current minor version and addon revisions used by the civic platform team. Keep the verification evidence—command output or config snippets—with the municipal runbook so audits can prove the control was applied as designed.