Discussed at the meetup. The CRD design we agreed on is:

nova:
  enabled: true
  template: ....
ironic:
  enabled: false
  template: ....

When a service was `enabled: true` and becomes `enabled: false`, we don't delete it. Instead we simply stop reconciling.