There is the  managedkafka.bf2.org/pause-reconciliation  annotation to indicate that an MK Kafka can be paused: if that annotation is set, the FSO will not update any of the dependent resources. 

At the moment, the annotation is not taken into account by the sync and the sync will still keep on trying to create/update the master secret for the instance. This logic needs to be enhanced to skip overriding kafka master secret - but sensitive content of the MK CR still needs to be stripped out.

rhn-engineering-shawkins as discussed