lsdmop chart duplicates ECK operator cluster-scoped resources causing Helm ownership conflicts

[phillipdebruin]

Problem

The elastic.operator.yaml template in the lsdmop chart contains vendored resources from the eck-operator chart (noted by the # Source: eck-operator/templates/... comments). This includes:

• ClusterRole/elastic-operator
• ClusterRole/elastic-operator-view
• ClusterRole/elastic-operator-edit
• ClusterRoleBinding resources
• ServiceAccount/elastic-operator
• ConfigMap/elastic-operator
• Webhook configuration

These same resources are already created by the eck-operator Helm release which is deployed as a separate helm_release in the MOP Terraform module.

Impact

When both charts are deployed in the same cluster, Helm's ownership model means only one release can own a given resource. The second release to touch a cluster-scoped resource fails with:

Unable to continue with update: ClusterRole "elastic-operator-view" in namespace ""
exists and cannot be imported into the current release: invalid ownership metadata;
annotation validation error: key "meta.helm.sh/release-name" must equal "lsdmop":
current value is "eck-operator"

This happens on every fresh cluster deployment depending on which chart installs first.

Expected fix

Remove all # Source: eck-operator/templates/... resources from elastic.operator.yaml. The ECK operator chart (helm.elastic.co/eck-operator) already manages its own RBAC, ServiceAccount, webhook, and ConfigMap resources. The lsdmop chart should not duplicate them.

Affected resources in elastic.operator.yaml

• Lines 2–65: Namespace, ServiceAccount, Webhook cert, ConfigMap
• Lines 67–340: ClusterRole/elastic-operator
• Lines 343–390: ClusterRole/elastic-operator-view
• Lines 392–438: ClusterRole/elastic-operator-edit
• Lines 440+: ClusterRoleBindings

Workaround

Manually reassign Helm ownership annotations on the conflicting resources:

kubectl annotate clusterrole elastic-operator-view meta.helm.sh/release-name=lsdmop --overwrite
kubectl annotate clusterrole elastic-operator-view meta.helm.sh/release-namespace=lsdmop --overwrite

Notes

This has existed since the chart was created — it was likely templated from an ECK operator install and vendored directly rather than relying on the separate operator chart.