When using the elasticsearchRef field to establish a trust relationship between Elasticsearch and a Kibana or an APM Server resource, the default behaviour is to allow association as long as both resources are deployed to namespaces managed by that particular ECK instance. Association succeeds even if the user does not have access to one of the namespaces, or only has access to Kibana resources and not Elasticsearch resources.

This section describes how you can restrict the associations that can be created between resources managed by ECK.