Removing only the managed operator stops Rancher from controlling the deployment while preserving the underlying logging custom resources. Removing the CRDs is much more destructive because it can eliminate the definitions that existing logging objects depend on. In a migration, preserving CRDs lets teams keep current logging configuration while they replace the operator layer.
What changes when you remove the operator versus the CRDs?
Removing the managed logging operator is usually a control-plane change: Rancher stops reconciling and managing the deployment, but the logging custom resources can remain in place. Removing the CRDs is a schema-level change: it removes the API definitions that those objects depend on, which is why it can break or orphan existing configuration during a migration.
That distinction matters because operators and CRDs play different roles in a Kubernetes-based platform. An operator manages behaviour and lifecycle, while CRDs define the object types that Kubernetes can store and serve. If you remove the operator first, you can often preserve the configuration and decide how to replace it; if you remove the CRDs first, you may remove the very objects that represent the logging setup you are trying to migrate.
- Operator removal is typically the safer first move when the goal is to hand control to a new logging stack.
- CRD removal is only appropriate once you have confirmed nothing still depends on those custom objects and you have a clean replacement path.
- The practical migration question is not just “is the component gone?”, but “what state, metadata, and dependencies remain readable after the change?”
Why preserving CRDs often makes migrations smoother
Preserving CRDs lets teams keep their existing logging configuration visible while they transition the underlying implementation. That reduces the risk of losing routing rules, retention settings, outputs, or other object-level intent that would otherwise have to be rebuilt from scratch. It also gives teams a reviewable state during cutover, which is useful when the new operator or platform is not yet fully trusted.
By contrast, deleting CRDs can force a hard reset of the object model. In practice, that means you are not just replacing software, you are removing the API contract for the resources that software managed. For migration planning, that difference determines whether the work is a controlled handoff or a full re-creation exercise.
- Keep CRDs when you want continuity of configuration and a reversible migration path.
- Remove CRDs only after verifying that the old objects are intentionally retired and no longer needed by any controller, user workflow, or automation.
- Expect more manual rebuild effort when the migration crosses API versions or changes resource structure.
Risk and Threat Considerations
Deleting CRDs too early can create operational loss, configuration drift, or accidental data-plane disruption because dependent objects may disappear or become impossible to reconcile. In a live cluster, that can turn a migration into an outage if teams assume the operator and the CRDs are interchangeable.
Failure mechanism: The operator is removed only from reconciliation, but the CRDs are removed from the API server before the replacement stack has safely adopted the existing custom resources, causing object loss, orphaning, or failed re-creation.
Impact: Logging configuration can be lost, monitoring coverage can gap during transition, and recovery may require manual reconstruction from backups or manifests.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS Control 4 — Secure Configuration of Enterprise Assets and Software | CRD and operator removal are software configuration changes that can break managed state. |
| CIS Control 7 — Continuous Vulnerability Management | Migration timing and dependency checks reduce the chance of disruptive removal during active use. | |
| Recommendation — Treat CRD deletion as a secure-configuration change and verify dependent objects before removal. Validate dependency exposure before decommissioning the old operator or its CRDs. | ||
| NIST CSF 2.0 | PR.IP — Information Protection Processes and Procedures | Safe migration depends on controlled change, retirement, and preservation of necessary configuration state. |
| RC.IM — Improvements | Migration lessons should feed back into change and decommissioning procedures for future rollouts. | |
| Recommendation — Document the retirement sequence so state is preserved until the replacement is operational. Update migration runbooks after cutover to prevent premature schema removal in later changes. | ||
Practitioner Guidance
What to verify: Confirm which resources are purely managed state and which are user-authored configuration before changing anything. If the old logging objects still represent the desired configuration, preserve them until the new path is proven.
Decision rule: If the goal is migration, remove the operator first and treat CRD deletion as a later decommissioning step, not part of the initial handoff. If the goal is full retirement, inventory every dependent object and confirm you can recreate or discard it safely.
Practitioner takeaway: The operator is the control plane, but the CRDs are the contract, so deleting the contract is always the more destructive action.
Related resources from NHI Mgmt Group
- What is the difference between keeping AI gateway analytics in customer-owned object storage and running a managed logging database in the provider cloud?
- What is the difference between managed identities and hardcoded secrets for AI agents?
- What is the difference between logging actions and logging intent for AI agents?
- What is the difference between managed identities and static secrets for agents?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
