Elastic Cloud on Kubernetes 3.5.0

Release Highlights

Dynamic namespaces

ECK now supports label-selector-based namespace scoping as an alternative to the static list of managed namespaces. When namespaceSelector is configured, the operator evaluates a Kubernetes label selector against namespace labels at runtime: when a namespace gains matching labels it is on-boarded immediately and the operator begins managing its Elastic resources; when a namespace's labels no longer match, it is off-boarded and the operator stops reconciling its resources. Both transitions happen live — no operator restart is required. This makes it straightforward to grow or shrink the set of managed namespaces by relabeling them, without any operator configuration changes. Dynamic namespace handling is an Enterprise feature. For more details, refer to the dynamic namespace handling documentation.

Pause orchestration annotation for maintenance windows

ECK now supports a eck.k8s.elastic.co/pause-orchestration annotation that temporarily suspends spec-driven orchestration on any ECK-managed resource. This is useful during maintenance windows — such as draining Kubernetes nodes or applying infrastructure changes — where you want to prevent ECK from applying spec changes while keeping essential housekeeping running. Unlike the existing eck.k8s.elastic.co/managed: "false" annotation (which stops all reconciliation entirely and is now deprecated), pausing orchestration keeps certificate rotation, service reconciliation, user and secret management, and health monitoring active, avoiding cluster degradation during extended pauses. The annotation is supported on all ECK-managed resource types, and its value is validated by the webhook. When orchestration is paused, ECK sets an OrchestrationPaused condition on the resource status; on resume, any pending spec changes are applied immediately. For more details, refer to the pause orchestration documentation.

Mutual TLS expansion across all Stack components

All Stack components that connect to elasticsearch — APM Server, Beats, Enterprise Search, Elastic Maps Server, Logstash, Elastic Agent (standalone), and Fleet Server — now automatically receive ECK-managed client certificates and present them when connecting to elasticsearch. For fleet-managed agents, Fleet Server propagates the client certificate information to all connected agents automatically, with no additional configuration required. For more details, refer to the elasticsearch client certificate authentication documentation.

Beyond securing connections to elasticsearch, Fleet Server can also be configured to require client certificates from the Elastic Agents connecting to it. This is an Enterprise feature. For more details, refer to the Fleet Server client certificate authentication documentation.

AutoOps agent collector configuration

The AutoOpsAgentPolicy resource now exposes spec.config and spec.configRef fields for tuning the AutoOps agent's collector configuration directly from the CRD, without manually editing configuration files. This gives you control over which metricsets are collected and at what interval. For more details, refer to the AutoOps data collection documentation.

Hot-reload of secure settings without pod restarts

For elasticsearch 9.5 and later, ECK now supports an opt-in file-based delivery mechanism for spec.secureSettings that eliminates the rolling restart previously required on every secret update. Enable it by adding the eck.k8s.elastic.co/file-based-secure-settings: "true" annotation to your elasticsearch resource; ECK then writes secrets directly into the elasticsearch file-based settings path and elasticsearch reloads them in place. For more details, refer to the secure settings documentation.

elasticsearch role definitions in StackConfigPolicy

The new securityRoles field in StackConfigPolicy lets you define custom elasticsearch roles declaratively within a policy and apply them consistently across all targeted clusters. ECK merges the definitions into the roles.yml file mounted on each elasticsearch pod and elasticsearch hot-reloads them without a pod restart. For more details, refer to the StackConfigPolicy documentation.

Dynamic substitution variables in StackConfigPolicy

The new variablesFrom field in StackConfigPolicy lets you load key-value pairs from ConfigMaps and Secrets as substitution variables, referenced as ${VAR} or ${VAR:-default} expressions in the policy's elasticsearch and kibana fields, so a single policy definition can be reused across environments with different values. ECK watches all referenced sources and reconciles automatically when they change. For more details, refer to the StackConfigPolicy documentation.

Reduced operator memory footprint

ECK 3.5 ships two complementary improvements to reduce the operator's memory usage in large clusters. The controller-runtime cache is now automatically scoped to only watch core workload resources (Pods, StatefulSets, Deployments, DaemonSets, PodDisruptionBudgets) that carry the ECK type label, avoiding the cost of caching unrelated workloads running in the same cluster. An additional opt-in flag, --restrict-watched-resources, further narrows the cache for Secrets, Services, and ConfigMaps to those explicitly labelled with eck.k8s.elastic.co/watched=true, which significantly reduces memory and API server load in clusters with large numbers of user-managed resources of those types.

Features and enhancements [elastic-cloud-kubernetes-350-features-and-enhancements]

Implement Logstash support for presenting client certificates to elasticsearch #9308
Implement Beats support for presenting client certificates to elasticsearch #9306
Implement Enterprise Search support for presenting client certificates to elasticsearch #9332
Implement APM Server support for presenting client certificates to elasticsearch #9307
Implement Elastic Maps Server support for presenting client certificates to elasticsearch #9331
Implement ECK monitoring support for presenting client certificates to elasticsearch #9334
Implement Fleet Server and Elastic Agent support for presenting client certificates to elasticsearch #9234
Implement AutoOps agent support for presenting client certificates to elasticsearch #9333
Implement mTLS support for Fleet Server and Elastic Agent connections #9399
Version-gate Fleet Server mTLS support #9486
Add pause-orchestration annotation support for elasticsearch #9330
Update annotator.sh script for the eck.k8s.elastic.co/pause-orchestration annotation #9354
Add pause-orchestration annotation support for Elastic Agent, and Beats (boilerplate) #9417
Add pause-orchestration annotation support for Elastic Agent, and Beats #9398
Add webhook validation for the pause-orchestration annotation #9474
Add pause-orchestration annotation support for Logstash #9484
Add pause-orchestration annotation support for AutoOps #9477
Reduce operator memory footprint by configuring cache to only watch ECK-labelled resources #9339
Introduce --restrict-watched-resources flag to narrow cache for Secrets, Services, and ConfigMaps #9359
Simplified container resources spec for all ECK CRDs #9346
Allow overriding AutoOps agent collector configuration via spec.config/spec.configRef #9507
Add support for kibana Spaces in Fleet integration policies #9410
Support elasticsearch role definitions in StackConfigPolicy #9442
Introduce dynamic substitution variables for StackConfigPolicy #9541
Validate secure settings sources against active StackConfigPolicies #9593
kibana readiness probes use status API #9468
Add map support for extraObjects in Helm charts #9478
Opt-in support for file-based cluster settings enabling hot-reload of secure settings without pod restarts #9458
Switch to Go native FIPS with a static binary #9538
Dynamic namespaces: label-selector-based namespace scoping (Enterprise feature) #9569
Relax custom CA secret parsing to support cert-manager secrets #9574
Batch elasticsearch keystore add-file invocations #9440
Move Condition types from common/v1alpha1 to common/v1 #9408

Fixes [elastic-cloud-kubernetes-350-fixes]

Fix dynamic watch leak on AutoOps resource selector change #9434
Fix unexpected pod restarts by scoping template hash computation to Spec #9437
AutoOps: prefer ca.crt over tls.crt for elasticsearch TLS verification #9463
Fix Logstash ignoring set-default-security-context operator flag #9551
Clean up service-account-token secrets on association Unbind #9562
Verify owner references when building client cert trust bundle #9561
Add missing RBAC for Kubernetes metricsets in agent ClusterRoles #9612
Store FLEET_SERVER_SERVICE_TOKEN in Secret instead of plaintext pod env var #9626
Gate Fleet Server minimum version to 8.13.0 for elasticsearch mTLS support #9598

:::{dropdown} Updated dependencies

Go 1.26.4 => 1.26.5
cloud.google.com/go/auth v0.20.0 => v0.22.0
cloud.google.com/go/storage v1.62.0 => v1.63.1
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.4 => v1.8.0
github.com/aws/aws-sdk-go-v2 v1.41.5 => v1.42.1
github.com/aws/aws-sdk-go-v2/credentials v1.19.14 => v1.19.29
github.com/aws/aws-sdk-go-v2/service/s3 v1.98.0 => v1.105.1
github.com/gkampitakis/go-snaps v0.5.21 => v0.5.23
github.com/google/go-containerregistry v0.21.4 => v0.21.7
github.com/prometheus/common v0.67.5 => v0.70.0
go.elastic.co/apm/module/apmelasticsearch/v2 v2.7.6 => v2.7.12
go.elastic.co/apm/module/apmhttp/v2 v2.7.6 => v2.7.12
go.elastic.co/apm/module/apmzap/v2 v2.7.6 => v2.7.12
go.elastic.co/apm/v2 v2.7.6 => v2.7.12
go.uber.org/zap v1.27.1 => v1.28.0
golang.org/x/crypto v0.53.0 => v0.54.0
golang.org/x/mod v0.36.0 => v0.37.0
golang.org/x/sync v0.21.0 => v0.22.0
golang.org/x/sys v0.46.0 => v0.47.0
golang.org/x/term v0.44.0 => v0.45.0
golang.org/x/text v0.38.0 => v0.40.0
golang.org/x/tools v0.45.0 => v0.47.0
google.golang.org/api v0.274.0 => v0.288.0
google.golang.org/grpc v1.81.1 => v1.82.0
k8s.io/api v0.35.3 => v0.36.2
k8s.io/apimachinery v0.35.3 => v0.36.2
k8s.io/client-go v0.35.3 => v0.36.2
sigs.k8s.io/controller-runtime v0.23.3 => v0.24.1
sigs.k8s.io/controller-tools v0.20.1 => v0.21.0

:::

3.4.1 [elastic-cloud-kubernetes-341-release-notes]