Pause orchestration on ECK

During maintenance windows, such as draining Kubernetes nodes or applying infrastructure changes, you can temporarily prevent ECK from applying spec changes to your Elastic resources. The eck.k8s.elastic.co/pause-orchestration annotation lets you freeze spec-driven orchestration on any ECK-managed resource while ECK continues essential maintenance tasks such as certificate rotation and health monitoring (see What continues and what pauses).

ECK provides two annotations that affect reconciliation behavior:

The key difference is that pause-orchestration keeps certificate rotation, service reconciliation, user and secret management, and health monitoring running. This avoids cluster degradation during extended maintenance windows. The annotation is supported on all ECK-managed resource types: Elasticsearch, Kibana, APM Server, Enterprise Search, Elastic Maps Server, Logstash, Elastic Agent, Beats, Elastic Package Registry, and AutoOps Agent Policy.

Set the annotation to "true" on any ECK resource:

apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: quickstart
  annotations:
    eck.k8s.elastic.co/pause-orchestration: "true"
spec:
  version: 9.4.4
  nodeSets:
  - name: default
    count: 3
		

Or using kubectl annotate:

kubectl annotate elasticsearch quickstart eck.k8s.elastic.co/pause-orchestration=true --overwrite
		

The same annotation works on any other resource type. Only the exact string values "true" and "false" are accepted — the webhook rejects any other value (for example "True", "1", or an empty string).

When orchestration is paused, ECK sets an OrchestrationPaused condition on the resource status. If spec changes are pending at the time of the pause, ECK also emits a Kubernetes warning event indicating that changes will be applied once the annotation is removed.

kubectl get elasticsearch quickstart -o jsonpath='{.status.conditions}' | jq .
		

On resume (annotation removed or set to "false"), ECK clears the condition and immediately applies any pending spec changes through the normal reconciliation path.