Lab Solution Install And Combine Two Operators

This lesson demonstrates how to run two independent Kubernetes operators in the same namespace without mixing ownership of their custom resources. You will install or verify two controllers, create the custom resources each operator manages, and confirm that each operator reconciles only its own resources.

cert-manager: manages certificate lifecycle (Issuer, Certificate) and produces TLS Secrets.
Prometheus Operator: manages monitoring lifecycle (ServiceMonitor, Prometheus) and generates the Prometheus workload.

These cert-manager components work together: the controller reconciles Certificate resources, the webhook validates cert-manager API requests, and cainjector injects CA trust data into Kubernetes resources.

Operators claim ownership only of the custom resources defined by their CRDs. Co-locating resources in the same Kubernetes namespace is useful for visibility, but it does not imply shared ownership or control.

Prerequisites and overview

Confirm cert-manager and Prometheus Operator deployments are running.
Create a single namespace combined to host the application-facing custom resources (the operators themselves run in their own namespaces).
Apply cert-manager resources (Issuer + Certificate) and verify a TLS Secret is produced.
Apply Prometheus resources (Deployment, Service, ServiceMonitor, Prometheus) and verify the operator generates the Prometheus StatefulSet.
Validate that each operator only reconciles its own resources and verify the label selector match between Prometheus and the ServiceMonitor.

Verify controllers and create namespace

Confirm both operator deployments are available, then create the combined namespace:

# Check cert-manager components
kubectl -n cert-manager get deploy cert-manager cert-manager-webhook cert-manager-cainjector

# Check Prometheus Operator deployment
kubectl -n monitoring get deploy prometheus-operator

# Create the shared namespace for application-facing resources
kubectl create namespace combined

Example output:

$ kubectl -n cert-manager get deploy cert-manager cert-manager-webhook cert-manager-cainjector
NAME                    READY   UP-TO-DATE   AVAILABLE   AGE
cert-manager            1/1     1            1           2m13s
cert-manager-webhook    1/1     1            1           2m13s
cert-manager-cainjector 1/1     1            1           2m13s

$ kubectl -n monitoring get deploy prometheus-operator
NAME                 READY   UP-TO-DATE   AVAILABLE   AGE
prometheus-operator  1/1     1            1           2m5s

Both sets of application-facing custom resources will live in the combined namespace while their controllers continue to run in separate operator namespaces.

cert-manager resources (Issuer + Certificate)

Inspect the cert-manager resources: an Issuer (who signs) and a Certificate (what certificate is requested and which Secret should receive it). The Certificate in this lesson targets the Secret web-tls in namespace combined.

cert-resources.yaml:

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: selfsigned
  namespace: combined
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: web-tls
  namespace: combined
spec:
  secretName: web-tls
  dnsNames:
    - apps.kodekloud.com
  issuerRef:
    name: selfsigned
    kind: Issuer

Apply the resources and wait for the Certificate to become Ready. The Ready condition means cert-manager has issued the certificate and populated the Secret.

kubectl apply -f cert-resources.yaml
kubectl -n combined wait --for=condition=Ready certificate/web-tls --timeout=180s

Example output:

certificate.cert-manager.io/web-tls condition met

Verify the Secret type is kubernetes.io/tls, the standard type used by applications for TLS secrets:

kubectl -n combined get secret web-tls -o jsonpath='{.type}{"\n"}'

Example output:

kubernetes.io/tls

Prometheus resources (Deployment, Service, ServiceMonitor, Prometheus)

Next, create the monitoring resources that the Prometheus Operator will reconcile. This example includes:

a small example Deployment that exports metrics,
a Service exposing the metrics port,
a ServiceMonitor that discovers the Service,
a Prometheus custom resource that selects ServiceMonitors via labels.

prometheus-resources.yaml:

# Deployment for example-app (exports metrics)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: example-app
  namespace: combined
  labels:
    app: example-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: example-app
  template:
    metadata:
      labels:
        app: example-app
    spec:
      containers:
      - name: app
        image: prom/node-exporter
        ports:
        - name: metrics
          containerPort: 9100
---
# Service exposing the metrics port for the Deployment
apiVersion: v1
kind: Service
metadata:
  name: example-app
  namespace: combined
spec:
  selector:
    app: example-app
  ports:
  - name: metrics
    port: 9100
    targetPort: metrics
---
# ServiceMonitor that targets the Service by label
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: example-app
  namespace: combined
  labels:
    team: combined
spec:
  selector:
    matchLabels:
      app: example-app
  endpoints:
    - port: metrics
---
# Prometheus custom resource that selects ServiceMonitors by label
apiVersion: monitoring.coreos.com/v1
kind: Prometheus
metadata:
  name: combined
  namespace: combined
spec:
  serviceAccountName: prometheus
  replicas: 1
  serviceMonitorSelector:
    matchLabels:
      team: combined

Apply the Prometheus resources:

kubectl apply -f prometheus-resources.yaml

Example apply output:

deployment.apps/example-app created
service/example-app created
serviceaccount/prometheus created
clusterrole.rbac.authorization.k8s.io/prometheus-combined created
clusterrolebinding.rbac.authorization.k8s.io/prometheus-combined created
servicemonitor.monitoring.coreos.com/example-app created
prometheus.monitoring.coreos.com/combined created

The Prometheus Operator reconciles the Prometheus CR and will create the actual Prometheus StatefulSet. The generated StatefulSet name may vary by operator version; this example expects prometheus-combined.

kubectl -n combined rollout status statefulset/prometheus-combined --timeout=300s

If the operator generated a differently named StatefulSet, find it with:

kubectl -n combined get statefulset

Quick reference: resources created in `combined` namespace

Resource Type	Purpose	Example resource/name
Issuer	Signs certificates	`Issuer/selfsigned`
Certificate	Requests TLS certificate into a Secret	`Certificate/web-tls`
Secret	TLS secret produced by cert-manager	`Secret/web-tls` (type `kubernetes.io/tls`)
Deployment	Example app that exposes metrics	`Deployment/example-app`
Service	Exposes metrics port for scraping	`Service/example-app`
ServiceMonitor	Service discovery for Prometheus	`ServiceMonitor/example-app`
Prometheus (CR)	Operator-managed Prometheus configuration	`Prometheus/combined`
StatefulSet	Operator-generated Prometheus instance	`StatefulSet/prometheus-combined` (name may vary)

Validate operator ownership and selector match

List and inspect resources in the combined namespace to confirm both workflows coexist without ownership overlap:

cert-manager produced web-tls Secret from the Certificate request.
Prometheus Operator generated the Prometheus StatefulSet and included the ServiceMonitor in its scrape targets.

Finally, verify the label selector match between the Prometheus resource and the ServiceMonitor. Both values should be combined so the ServiceMonitor is included in Prometheus’ configuration:

# Get the serviceMonitorSelector label value from the Prometheus CR
kubectl -n combined get prometheus combined -o jsonpath='{.spec.serviceMonitorSelector.matchLabels.team}{"\n"}'

# Get the label value from the ServiceMonitor
kubectl -n combined get servicemonitor example-app -o jsonpath='{.metadata.labels.team}{"\n"}'

Expected output:

combined
combined

When these match, the Prometheus Operator includes the ServiceMonitor target in Prometheus’ generated scrape configuration.

Summary

You now have two operators performing different responsibilities within the same namespace:

cert-manager issued a certificate and wrote a kubernetes.io/tls Secret for application consumption.
Prometheus Operator generated the Prometheus StatefulSet and configured scraping via the ServiceMonitor you created.

Running multiple operators side-by-side is a common pattern; namespaces are convenient observation boundaries but do not change CR ownership. For more details see the operator projects:

Introduction to Operator Fundamentals

Custom Resource Definitions Deep Dive

Kubebuilder Scaffolding

Building The WebApp Operator Core Reconcile

Running Testing Debugging Locally

Status Conditions Events

Finalizers And Cleanup

Validation Webhooks And CEL Policies

Packaging And Distribution

Alternative Approaches Operator SDK Helm Operator

Consuming Popular Operators

Production Readiness Testing Wrap Up

Lab Solution Install And Combine Two Operators

Prerequisites and overview

Verify controllers and create namespace

cert-manager resources (Issuer + Certificate)

Prometheus resources (Deployment, Service, ServiceMonitor, Prometheus)

Quick reference: resources created in `combined` namespace

Validate operator ownership and selector match

Summary

Watch Video

​Prerequisites and overview

​Verify controllers and create namespace

​cert-manager resources (Issuer + Certificate)

​Prometheus resources (Deployment, Service, ServiceMonitor, Prometheus)

​Quick reference: resources created in combined namespace

​Validate operator ownership and selector match

​Summary

Watch Video

Prerequisites and overview

Verify controllers and create namespace

cert-manager resources (Issuer + Certificate)

Prometheus resources (Deployment, Service, ServiceMonitor, Prometheus)

Quick reference: resources created in `combined` namespace

Validate operator ownership and selector match

Summary