Dynamic namespace handling

By default, the ECK operator manages either all namespaces in the cluster or a static list of namespaces defined through the namespaces configuration option. Dynamic namespace handling replaces the static list with a Kubernetes label selector: the operator evaluates the selector against each namespace's labels at runtime to determine which namespaces it manages.

When a namespace gains labels that match the selector, the operator starts managing the Elastic resources in it. This is called namespace onboarding. When a namespace stops matching the selector, it is offboarded and the operator stops managing its resources. The operator watches for label changes and updates its managed namespaces automatically. No operator restart is required.

With a namespace selector configured, the operator watches all namespaces cluster-wide and filters the events it receives by matching each namespace's current labels against the selector:

• Events from resources in non-matching namespaces are ignored, and the operator does not reconcile those resources.
• The operator also watches Namespace objects themselves. When a namespace enters or leaves the selector's scope, the operator immediately enumerates the Elastic resources in that namespace and starts or stops managing them.
• The validating webhook applies the same filtering: resources in namespaces that do not match the selector are not validated (admission requests for them are silently accepted rather than blocked).
• The namespace in which the operator itself runs is always considered managed, regardless of its labels.

The namespace selector supports the standard Kubernetes matchLabels and matchExpressions semantics, and is subject to the following constraints:

• It is mutually exclusive with the static list of managed namespaces (namespaces in the operator configuration, managedNamespaces in the Helm chart).
• It requires the operator to run with cluster-wide permissions, because the operator must watch namespaces and Elastic resources across the whole cluster. It is therefore not compatible with the restricted installation mode of the Helm chart.
• An empty selector ({}) disables dynamic namespace handling, and the operator manages all namespaces.

If you installed ECK through the Helm chart, set the managedNamespaceSelector value. This is a top-level chart value, not part of the config section:

managedNamespaceSelector:
  matchLabels:
    eck-managed: "true"
		

Or using matchExpressions:

managedNamespaceSelector:
  matchExpressions:
    - key: environment
      operator: In
      values: [production, staging]
		

Instead of a values file, you can also set the selector directly on the command line when installing or upgrading the release:

helm upgrade elastic-operator elastic/eck-operator -n elastic-system \
  --reuse-values \
  --set-string 'managedNamespaceSelector.matchLabels.eck-managed=true'
		

Note the use of --set-string, which prevents Helm from interpreting the label value true as a Boolean. Namespace label values are always strings. If the label key contains dots, escape them with \., for example, managedNamespaceSelector.matchLabels.kubernetes\.io/metadata\.name.

If you installed ECK using the YAML manifests, add the namespace-selector option to the eck.yaml key of the elastic-operator ConfigMap, as described in Apply ECK configuration settings:

namespace-selector:
  matchLabels:
    eck-managed: "true"
		

To onboard a namespace, apply the labels that match the configured selector. For example, with a selector matching eck-managed: "true":

kubectl label namespace my-namespace eck-managed=true
		

The operator picks up any existing Elastic resources in the namespace and starts reconciling them immediately.

To offboard a namespace, remove or change the labels so that the namespace no longer matches the selector:

kubectl label namespace my-namespace eck-managed-
		

Dynamic namespace handling is an Enterprise feature. While no valid Enterprise license is present, the operator skips the reconciliation of Elastic resources entirely, emits a Kubernetes event indicating that Enterprise features are turned off, and retries every 5 minutes. As soon as a valid Enterprise license or trial license is installed, reconciliation resumes automatically.

Create the license secret in the operator's namespace, as described in Manage your license in ECK. This is particularly important with dynamic namespace handling: the operator's namespace is always in scope regardless of its labels, so a license stored there can never be offboarded together with a managed namespace.