# Elastic observability

`elastic-operator` adopts the existing upstream ECK 3.5.0 Helm release in
`elastic`. The separate `elastic` Application owns the existing Elasticsearch,
Kibana, Beat, and Agent custom resources plus their cluster-specific ConfigMap,
Service, and Ingress. ECK alone owns the generated StatefulSet, Deployments,
DaemonSet, Services, and credentials.

The three Elasticsearch data PVCs predate Argo and must retain their UIDs and
bound volumes. Both Applications deliberately disable pruning. In particular,
the existing Elasticsearch custom resource specifies
`DeleteOnScaledownAndClusterDeletion`; deleting it can delete its data claims.
Do not delete or rename it as part of a GitOps cleanup.

The MikroTik IPFIX export and the Kibana dashboard/pipeline/ILM API assets are
outside Kubernetes and remain managed by the historical `elastic` repository's
router and asset scripts. The Kubernetes resource source of truth is here; the
old repository's direct Kubernetes deploy workflow must not run after cutover.