Elastic Cloud on Kubernetes release notes

Review the changes, fixes, and more in each release of Elastic Cloud on Kubernetes.

ECK now supports label-selector-based namespace scoping as an alternative to the static list of managed namespaces. When namespaceSelector is configured, the operator evaluates a Kubernetes label selector against namespace labels at runtime: when a namespace gains matching labels it is on-boarded immediately and the operator begins managing its Elastic resources; when a namespace's labels no longer match, it is off-boarded and the operator stops reconciling its resources. Both transitions happen live — no operator restart is required. This makes it straightforward to grow or shrink the set of managed namespaces by relabeling them, without any operator configuration changes. Dynamic namespace handling is an Enterprise feature. For more details, refer to the dynamic namespace handling documentation.

ECK now supports a eck.k8s.elastic.co/pause-orchestration annotation that temporarily suspends spec-driven orchestration on any ECK-managed resource. This is useful during maintenance windows — such as draining Kubernetes nodes or applying infrastructure changes — where you want to prevent ECK from applying spec changes while keeping essential housekeeping running. Unlike the existing eck.k8s.elastic.co/managed: "false" annotation (which stops all reconciliation entirely and is now deprecated), pausing orchestration keeps certificate rotation, service reconciliation, user and secret management, and health monitoring active, avoiding cluster degradation during extended pauses. The annotation is supported on all ECK-managed resource types, and its value is validated by the webhook. When orchestration is paused, ECK sets an OrchestrationPaused condition on the resource status; on resume, any pending spec changes are applied immediately. For more details, refer to the pause orchestration documentation.

All Stack components that connect to Elasticsearch — APM Server, Beats, Enterprise Search, Elastic Maps Server, Logstash, Elastic Agent (standalone), and Fleet Server — now automatically receive ECK-managed client certificates and present them when connecting to Elasticsearch. For fleet-managed agents, Fleet Server propagates the client certificate information to all connected agents automatically, with no additional configuration required. For more details, refer to the Elasticsearch client certificate authentication documentation.

Beyond securing connections to Elasticsearch, Fleet Server can also be configured to require client certificates from the Elastic Agents connecting to it. This is an Enterprise feature. For more details, refer to the Fleet Server client certificate authentication documentation.

The AutoOpsAgentPolicy resource now exposes spec.config and spec.configRef fields for tuning the AutoOps agent's collector configuration directly from the CRD, without manually editing configuration files. This gives you control over which metricsets are collected and at what interval. For more details, refer to the AutoOps data collection documentation.

For Elasticsearch 9.5 and later, ECK now supports an opt-in file-based delivery mechanism for spec.secureSettings that eliminates the rolling restart previously required on every secret update. Enable it by adding the eck.k8s.elastic.co/file-based-secure-settings: "true" annotation to your Elasticsearch resource; ECK then writes secrets directly into the Elasticsearch file-based settings path and Elasticsearch reloads them in place. For more details, refer to the secure settings documentation.

The new securityRoles field in StackConfigPolicy lets you define custom Elasticsearch roles declaratively within a policy and apply them consistently across all targeted clusters. ECK merges the definitions into the roles.yml file mounted on each Elasticsearch pod and Elasticsearch hot-reloads them without a pod restart. For more details, refer to the StackConfigPolicy documentation.

The new variablesFrom field in StackConfigPolicy lets you load key-value pairs from ConfigMaps and Secrets as substitution variables, referenced as ${VAR} or ${VAR:-default} expressions in the policy's elasticsearch and kibana fields, so a single policy definition can be reused across environments with different values. ECK watches all referenced sources and reconciles automatically when they change. For more details, refer to the StackConfigPolicy documentation.

ECK 3.5 ships two complementary improvements to reduce the operator's memory usage in large clusters. The controller-runtime cache is now automatically scoped to only watch core workload resources (Pods, StatefulSets, Deployments, DaemonSets, PodDisruptionBudgets) that carry the ECK type label, avoiding the cost of caching unrelated workloads running in the same cluster. An additional opt-in flag, --restrict-watched-resources, further narrows the cache for Secrets, Services, and ConfigMaps to those explicitly labelled with eck.k8s.elastic.co/watched=true, which significantly reduces memory and API server load in clusters with large numbers of user-managed resources of those types.

• Implement Logstash support for presenting client certificates to Elasticsearch #9308
• Implement Beats support for presenting client certificates to Elasticsearch #9306
• Implement Enterprise Search support for presenting client certificates to Elasticsearch #9332
• Implement APM Server support for presenting client certificates to Elasticsearch #9307
• Implement Elastic Maps Server support for presenting client certificates to Elasticsearch #9331
• Implement ECK monitoring support for presenting client certificates to Elasticsearch #9334
• Implement Fleet Server and Elastic Agent support for presenting client certificates to Elasticsearch #9234
• Implement AutoOps agent support for presenting client certificates to Elasticsearch #9333
• Implement mTLS support for Fleet Server and Elastic Agent connections #9399
• Version-gate Fleet Server mTLS support #9486
• Add pause-orchestration annotation support for Elasticsearch #9330
• Update annotator.sh script for the eck.k8s.elastic.co/pause-orchestration annotation #9354
• Add pause-orchestration annotation support for Elastic Agent, and Beats (boilerplate) #9417
• Add pause-orchestration annotation support for Elastic Agent, and Beats #9398
• Add webhook validation for the pause-orchestration annotation #9474
• Add pause-orchestration annotation support for Logstash #9484
• Add pause-orchestration annotation support for AutoOps #9477
• Reduce operator memory footprint by configuring cache to only watch ECK-labelled resources #9339
• Introduce --restrict-watched-resources flag to narrow cache for Secrets, Services, and ConfigMaps #9359
• Simplified container resources spec for all ECK CRDs #9346
• Allow overriding AutoOps agent collector configuration via spec.config/spec.configRef #9507
• Add support for Kibana Spaces in Fleet integration policies #9410
• Support Elasticsearch role definitions in StackConfigPolicy #9442
• Introduce dynamic substitution variables for StackConfigPolicy #9541
• Validate secure settings sources against active StackConfigPolicies #9593
• Kibana readiness probes use status API #9468
• Add map support for extraObjects in Helm charts #9478
• Opt-in support for file-based cluster settings enabling hot-reload of secure settings without pod restarts #9458
• Switch to Go native FIPS with a static binary #9538
• Dynamic namespaces: label-selector-based namespace scoping (Enterprise feature) #9569
• Relax custom CA secret parsing to support cert-manager secrets #9574
• Batch Elasticsearch keystore add-file invocations #9440
• Move Condition types from common/v1alpha1 to common/v1 #9408

• Fix dynamic watch leak on AutoOps resource selector change #9434
• Fix unexpected pod restarts by scoping template hash computation to Spec #9437
• AutoOps: prefer ca.crt over tls.crt for Elasticsearch TLS verification #9463
• Fix Logstash ignoring set-default-security-context operator flag #9551
• Clean up service-account-token secrets on association Unbind #9562
• Verify owner references when building client cert trust bundle #9561
• Add missing RBAC for Kubernetes metricsets in agent ClusterRoles #9612
• Store FLEET_SERVER_SERVICE_TOKEN in Secret instead of plaintext pod env var #9626
• Gate Fleet Server minimum version to 8.13.0 for Elasticsearch mTLS support #9598

ECK now supports configuring Elasticsearch to require client certificates for authentication. This allows you to enforce mutual TLS (mTLS) between clients and Elasticsearch, strengthening security by requiring both the client and server to present valid certificates. Currently, Elasticsearch and Kibana support this feature - Kibana can be configured to present client certificates when connecting to Elasticsearch. Support for the remaining components that connect to Elasticsearch (Beats, Elastic Agent, APM Server, Logstash, and so on) will follow in future releases. For more details, refer to the client certificate authentication documentation.

ECK now supports triggering rolling restarts of Elasticsearch clusters through a new annotation-based mechanism. This enables operators to gracefully restart all nodes in a cluster without manual intervention, useful for troubleshooting. The rolling restart documentation provides more details.

ECK simplifies the configuration of zone awareness for Elasticsearch clusters, reducing the amount of boilerplate configuration needed to set up topology-aware allocation. For more details, refer to the zone awareness documentation.

ECK container images are now signed using Sigstore cosign. This allows users to verify the authenticity and integrity of ECK operator images before deployment, strengthening the supply chain security of their Kubernetes clusters.

ECK now automatically manages a password-protected keystore for Elasticsearch when FIPS mode is enabled. When xpack.security.fips_mode.enabled is set to true in the Elasticsearch configuration, the operator generates, stores, and configures a password-protected keystore — eliminating the need for manual podTemplate overrides. This feature activates for Elasticsearch 9.4.0+ and respects any existing user-provided keystore password configuration. For more details, refer to the Elasticsearch FIPS keystore password documentation.

• Implement client certificate required support for Elasticsearch #9229
• Implement Kibana support for presenting client certificates to Elasticsearch #9230
• Support rolling restarts of Elasticsearch clusters #9172
• Simplify zone awareness #9148
• Operator-managed FIPS keystore password support for Elasticsearch #9287 (issue: #9171)
• Surface webhook warnings; Refactor webhooks to use controller-runtime's Validator #9235
• Add extraObjects support to ECK Helm charts #9069
• Add kubeAPIServerPort configuration option to Helm chart #8980
• Set seccompProfile to RuntimeDefault #9012
• Validate user-supplied HTTP CA certificate #8992
• Sign ECK container images (v2) #9078
• Improve license signature verification error to diagnose wrong license type #9262
• Improve AutoOpsAgentPolicy status reporting #9095
• Support runAsNonRoot true for recent versions of EPR #8974
• Reduce operator memory footprint by stripping managed fields from informer caches #9321
• Add version-gated querylog fileset to Filebeat sidecar config #9291
• Bump default Kibana memory limit from 1Gi to 2Gi #9328
• Add image digest support to eck-operator Helm chart #9362

• Prevent StackConfigPolicy controller from performing unnecessary file-settings secret updates on every reconciliation #9316
• Correct NetworkPolicy namespace selector label for soft multi-tenancy #9153
• Prevent using a nodeSet name while the equivalent StatefulSet already exists #9036
• Skip default PVC if volume with same name exists #9199 (issue: #8744)
• Avoid empty reconcile requests in StackConfigPolicy secret watch #9179
• Make remote-ca secret generation failures non-blocking #9271
• Garbage collect Agent soft-owned secrets on deletion #9090
• Detect stale CA in certificate chain and trigger certificates reissuance #9197
• Skip per-shard replica checks for GREEN clusters in require_started_replica predicate #9188
• Handle server side default for TrafficDistribution #8994
• Set default security context to Kibana init container #9218
• Validate user-supplied CA for the transport layer of Elasticsearch #8953
• Align DaemonSet UpdateReconciled with Deployment reconciler #9256 (issue: #9246)

• Add recipe for manual mTLS configuration #9124
• Mention PodTopologyLabelsAdmission in Elasticsearch sample #9035
• Logstash Chart improvements #9087

ECK 3.3.2 fixes the FIPS build by correctly enabling the BoringCrypto experiment via GOEXPERIMENT=boringcrypto. This release also adds preliminary support for native Go FIPS 140-3 mode (introduced in Go 1.24), which will be enabled in a future release once the module is certified.

• Fix FIPS build and add native Go FIPS 140-3 support #9263

ECK 3.3.1 has removed the enterprise requirement for AutoOpsAgentPolicy. AutoOps can now be used by on premises users without the need for an enterprise license.

• Removing enterprise requirement for AutoOpsAgentPolicy #9125
• Add Namespace Selector to AutoOpsAgentPolicy #8991
• Update minimum AutoOps Agent to 9.2.4 when a Basic license is used #9157

ECK now supports integration with Elastic AutoOps through a new AutoOpsAgentPolicy custom resource. This allows you to instrument multiple Elasticsearch clusters at once for automated health monitoring and performance recommendations. The AutoOps documentation provides more details.

ECK now supports deploying and managing Elastic Package Registry (EPR) through a new PackageRegistry custom resource. This is particularly useful for air-gapped environments, enabling Kibana to reference a self-hosted registry instead of the public one. The package registry documentation provides more details.

ECK now includes support for multiple Stack Config Policies targeting the same Elasticsearch cluster or Kibana instance, using a weight-based priority system for deterministic policy composition. The Stack Config Policy documentation provides more details.

• AutoOpsAgentPolicy support #8941 (issue: #8789)
• ElasticPackageRegistry support #8800 (issue: #8925)
• Stack Config Policies composition support #8917
• Use standard Kibana labels and Helm labels on the ECK Operator pod #8840 (issue: #8584)
• Add service customization support for Elasticsearch remote cluster server #8892
• Removal of Elasticsearch 6.x support from codebase #8979

• Upgrade master StatefulSets last when performing a version upgrade of Elasticsearch #8871 (issue: #8429)
• Fix race condition for pre-existing Stack Config Policy #8928 (issue: #8912)
• Do not set Kibana server.name #8930 (issue: #8929)
• Do not write elasticsearch.k8s.elastic.co/managed-remote-clusters when not necessary #8932 (issue: #8781)
• Cleanup orphaned secret mounts when removed from StackConfigPolicy #8937 (issue: #8921)
• Avoid duplicate error logging for generate GET operations on a GVK #8957
• Remove single master at a time upscale restriction #8940 (issue: #8939)

• Update Google Cloud LoadBalancer recipe for new requirements #8843
• Fix minUnavailable typo in PDB documentation #8898
• Use GKE ComputeClass instead of DaemonSet for GKE AutoPilot #8982
• Adjust vm.max_map_count to 1048576 in GKE AutoPilot recipes #8986
• Remove support for Stack 7.17. #9038

ECK now offers better out-of-the-box PodDisruptionBudgets that automatically keep your cluster available as Pods move across nodes. The new policy calculates the number of Pods per tier that can sustain replacement, and automatically generates a PodDisruptionBudget for each tier. This enables the Elasticsearch cluster to vacate Kubernetes nodes more quickly, while considering cluster health, without interruption. The documentation about PodDisruptionBudget has more information and details.

ECK now supports configuring the length of the generated password for the administrative user of each Elasticsearch cluster. While the default length remains 24 characters, this can now be configured up to a maximum of 72 characters. The password incorporates alphabetic and numeric characters to ensure strong complexity. Refer to the managed credentials page for examples and more details.

• Enable certificate reloading for stack monitoring Beats #8833 (issue: #5448)
• Allow configuration of file-based password character set and length #8817 (issues: #2795, #8693)
• Automatically set GOMEMLIMIT based on cgroups memory limits #8814 (issue: #8790)
• Introduce granular PodDisruptionBudgets based on node roles #8780 (issue: #2936)

• Gate advanced Fleet config logic to Agent v8.13 and later #8869
• Ensure Agent configuration and state persist across restarts in Fleet mode #8856 (issue: #8819)
• Do not set credentials label on Kibana config secret #8852 (issue: #8839)
• Allow elasticsearchRef.secretName in Kibana helm validation #8822 (issue: #8816)

• Update Logstash recipes from to filestream input #8801
• Recipe for exposing Fleet server to outside of the Kubernetes cluster #8788
• Clarify secretName restrictions #8782
• Update ES_JAVA_OPTS comments and explain auto-heap behavior #8753

It is now possible to propagate metadata from the parent custom resource to the child resources created by the operator. If you add labels or annotations on an Elasticsearch, Kibana, or Agent resource, for example, these can be automatically propagated to the Pods, Services, and other resources created by the operator. Refer to the Propagate Labels and Annotations page for examples and more details.

To reduce the attack surface and improve overall security UBI images are now based on the UBI micro base image.

• UBI: Use micro image instead of minimal #8704
• Propagate metadata to children #8673 (issue: #2652)
• Allow advanced configuration for fleet-managed Elastic Agents #8623 (issue: #8619)

• Set owner on service account Secret, update it when application is recreated #8716
• fix: Cannot disable TLS in Logstash #8706 (issue: #8600)
• Move from deprecated container input to filestream #8679 (issue: #8667)
• Add automated workaround for 9.0.0 maps issue #8665 (issue: #8655)
• Bump go.mod to v3 #8609
• Helm: Add support for missing remoteClusterServer value #8612
• Add logs volume for Filebeat and Metricbeat in stack monitoring #8606 (issue: #8605)

• [Helm] Fix examples/logstash/basic-eck.yaml #8695

• ECK 3.0.0 adds support for Elastic Stack version 9.0.0. Elastic Stack version 9.0.0 is not supported on ECK operators running versions earlier than 3.0.0.

• Add support for defining dnsPolicy and dnsConfig options for the ECK operator StatefulSet #7999
• Config: Allow escaping dots in keys via [unsplit.key] syntax #8512 (issue: #8499)
• Enable copying of ECK images to Amazon ECR to make it easier for users to find our own ECK operator in the AWS marketplace #8427
• Support new agent image path as of 9.0 #8518
• Remove ubi suffix for 9.x images #8509
• Remove support for 6.x Stack version #8507
• Log resourceVersion on Create and Update #8503
• Remove policyID validation #8449 (issue: #8446)
• Refactor APM server for 9.0.0 #8448 (issue: #8447)
• Improve error messages and events during Fleet setup #8350
• Validate updates to 9.0 go through 8.18 #8559 (issue: #8557)

• Correctly parse managed namespaces when specified as an environment variable #8513 (issue: #7542)

• [DOCS] Updates release notes title (#8599)
• Updates for Istio 1.24 (#8476)
• Fix unresolved attribute in ECK Quickstart (#8432)
• [Docs] Add synthetic monitoring example (#8385) (issue: #6294)
• [docs] Update heap dump command to use the most recent Java process (#8294)
• [DOC] Document the need for an ingest node for Enterprise Search analytics (#8271)