Association fails when Kibana and Elasticsearch are managed by different operators

[charith-elastic]

Scenario:

• Operator-A manages namespace A
• Operator-B manages namespace B
• Deploy Elasticsearch to namespace A
• Deploy Kibana to namespace B with a reference to Elasticsearch deployed in namespace A

Outcome:

Kibana pods don't get deployed because the operator fails to find the Elasticsearch backend.

Aborting Kibana deployment reconciliation as no Elasticsearch backend configured

This is probably because the Kibana association controller requires access to both namespaces in order to create the association. The current operator deployment model does not support this configuration.

Related issues:

• Global vs. namespace vs. configurable operators #374
• Add e2e tests for multi-namespaces deployments #782

[charith-elastic]

After looking into this a little bit more, I think the issue is that the cross-namespace Elasticsearch watch created by the Kibana association controller never succeeds because the controller-runtime currently supports watching a single namespace only. Once we upgrade to v0.2.0 of the controller-runtime, we can start making use of the multi namespace cache and potentially fix this problem.

[sebgl]

To give a bit more context to this issue:

We currently have 3 controllers running in the operator to manage ES and Kibana:

• the Elasticsearch controller, managing Elasticsearch resources. Needs access to the Elasticsearch namespace.
• the Kibana controller, managing Kibana resources. Needs access to the Kibana namespace.
• the Kibana association controller, managing the ES credentials for Kibana. Needs access to both Elasticsearch and Kibana namespaces, since it will create additional secrets in both namespaces, and patch the Kibana resource.

With #374, we describe a way for the user to pick which controllers they want to run, with which associated namespace. The user could choose to run any combination of controller/namespace to achieve the case you describe in the first post. That is:

• deploy an operator in namespace A, with the ES controller and the Kibana assocation controller
• deploy an operator in namespace B, with the Kibana controller only (to be managed by a team who should not have access to namespace A nor the ES cluster)

As you pointed out, we cannot achieve that yet since we're waiting for controller-runtime v0.2.0 (our related issue).

I think another reason why this is not possible/implemented yet (other than the multi-namespace watch feature) is that we don't really know whether the situation we describe here is an actual use case. Is it maybe just us over-engineering something nobody will never use?

[pebrc]

Closing as this is not a supported use case. Please reopen if you feel we should mention it in our documentation.