Pause orchestration on ECK
Elastic Cloud on Kubernetes extends Kubernetes orchestration capabilities to allow you to deploy and manage components of the Elastic Stack. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
ECK
3.5+
Generally available since 3.5
During maintenance windows, such as draining Kubernetes nodes or applying infrastructure changes, you can temporarily prevent ECK from applying spec changes to your Elastic resources. The eck.k8s.elastic.co/pause-orchestration annotation lets you freeze spec-driven orchestration on any ECK-managed resource while ECK continues essential maintenance tasks such as certificate rotation and health monitoring (see What continues and what pauses).
ECK provides two annotations that affect reconciliation behavior:
| Annotation | Availability | Effect |
|---|---|---|
eck.k8s.elastic.co/pause-orchestration: "true" |
Elastic Cloud on Kubernetes extends Kubernetes orchestration capabilities to allow you to deploy and manage components of the Elastic Stack. Availability Generally available since 3.5 This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. | Pauses spec-driven changes only. Housekeeping continues. |
eck.k8s.elastic.co/managed: "false" |
Elastic Cloud on Kubernetes extends Kubernetes orchestration capabilities to allow you to deploy and manage components of the Elastic Stack. Availability Deprecated since 3.5 This functionality is deprecated. You can still use it, but it'll be removed in a future Elastic Cloud on Kubernetes update. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. | Stops all reconciliation entirely. Deprecated in favor of pause-orchestration. |
The key difference is that pause-orchestration keeps certificate rotation, service reconciliation, user and secret management, and health monitoring running. This avoids cluster degradation during extended maintenance windows. The annotation is supported on all ECK-managed resource types: Elasticsearch, Kibana, APM Server, Enterprise Search, Elastic Maps Server, Logstash, Elastic Agent, Beats, Elastic Package Registry, and AutoOps Agent Policy.
Set the annotation to "true" on any ECK resource:
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
name: quickstart
annotations:
eck.k8s.elastic.co/pause-orchestration: "true"
spec:
version: 9.5.6
nodeSets:
- name: default
count: 3
Or using kubectl annotate:
kubectl annotate elasticsearch quickstart eck.k8s.elastic.co/pause-orchestration=true --overwrite
The same annotation works on any other resource type. Only the exact string values "true" and "false" are accepted — the webhook rejects any other value (for example "True", "1", or an empty string).
| Operation | Behavior when paused |
|---|---|
| Certificate rotation (HTTP and transport) | Continues |
| Service reconciliation | Continues |
| User and role reconciliation | Continues |
| Health monitoring and status updates | Continues |
| Keystore reconciliation | Continues |
| Pod disruption budget reconciliation | Continues |
| StatefulSet or Deployment spec updates | Paused |
| Rolling upgrades | Paused |
| Scale up and scale down | Paused |
| Volume expansion | Paused |
When orchestration is paused, ECK sets an OrchestrationPaused condition on the resource status. If spec changes are pending at the time of the pause, ECK also emits a Kubernetes warning event indicating that changes will be applied once the annotation is removed.
kubectl get elasticsearch quickstart -o jsonpath='{.status.conditions}' | jq .
On resume (annotation removed or set to "false"), ECK clears the condition and immediately applies any pending spec changes through the normal reconciliation path.