Elastic Cloud on Kubernetes breaking changes

ECK 3.4.0 includes changes that modify the Elasticsearch pod spec, triggering a rolling restart of all Elasticsearch pods during the operator upgrade. These changes include setting seccompProfile to RuntimeDefault and updated pre-stop hook and readiness probe scripts for client certificate authentication support.

Impact
All Elasticsearch pods will be restarted as part of the operator upgrade.

Action
No action required. Be aware that Elasticsearch pods will restart during the upgrade.

ECK 3.4.0 includes changes that modify the Kibana pod spec, triggering a rolling restart of Kibana pods during the operator upgrade. These changes include setting seccompProfile to RuntimeDefault, a new default security context on the init container, and an increase of the default memory limit from 1Gi to 2Gi. The memory limit increase addresses OOM crashes for Kibana 9.4.0+ where the 1Gi limit does not provide enough headroom for plugin initialization.

Impact
Kibana pods will be restarted as part of the operator upgrade. Pods without explicit memory limits will consume up to 2Gi of memory instead of 1Gi.

Action
Ensure that cluster nodes have sufficient memory to accommodate the increased default. If you have explicitly set a memory limit in the Kibana podTemplate, the memory limit change does not affect you. However, if you have set a memory limit lower than 2Gi, be aware that Kibana 9.4.0+ may experience OOM crashes due to the increased V8 heap usage.

ECK 3.4.0 unifies how the operator handles default volume claim templates. Previously, the operator only skipped adding a default PVC when a non-PVC volume (such as emptyDir or hostPath) with the same name existed. Now, it skips the default PVC whenever any volume with the same name exists, including user-provided PVCs.

Impact
If you defined custom PVC volumes in podTemplate.spec.volumes with the same name as a default volume (for example elasticsearch-data), those custom volumes were previously ignored and default volumes were provisioned instead. After upgrading, the operator will attempt to use your custom PVC volumes, which may cause a StatefulSet update rejection by Kubernetes.

Action
If you encounter a StatefulSet update error after upgrading, remove the custom PVC entries from podTemplate.spec.volumes that overlap with default volume names.

The standalone Enterprise Search, App Search and Workplace Search products remain available in maintenance mode and are no longer recommended for new search experiences. We recommend transitioning to our actively developed Elastic Stack tools to build new semantic and AI powered search experiences. There will be no standalone Enterprise Search 9.x image to update to. For more information, check Migrating to 9.x from Enterprise Search 8.x versions.

Impact
The upgrade to version 9.0.0 is not possible for standalone Enterprise search resources.

Action
Migrate away from Enterprise Search following this guide. Only once the standalone Enterprise Search resources have been deleted attempt the upgrade of the Elastic Stack to version 9.0.0.