Eck 3.5.0 release by moukoublen · Pull Request #7590 · elastic/docs-content

moukoublen · 2026-07-27T14:53:41Z

Update the documentation for the upcoming ECK 3.5.0 release

This pr contains all of these sub-PRs that have been approved individually.

Expect this commit 013667f that is new to this PR.

## Summary Add documentation for the ECK feature Dynamic Namespaces Handling. (GH Issue: [here](elastic/cloud-on-k8s#9490) PR: [here](elastic/cloud-on-k8s#9569)) ## Generative AI disclosure  1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [X] Yes - [ ] No 2. If you answered "Yes" to the previous question, please specify the tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.). Tool(s) and model(s) used: Claude Fable 5 > Note: this PR is targeting an intermediate branch `eck-3.5.0` that will be pull-requested to `main` once the new release 3.5.0 is GA

…windows (#7476)  ## Summary  Adds a new ECK 3.5 page documenting the `eck.k8s.elastic.co/pause-orchestration` annotation, covering supported resources, what continues vs. pauses, observability via the OrchestrationPaused condition, and its distinction from the deprecated `managed=false` annotation. ## Generative AI disclosure  1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [x] Yes - [ ] No Tool(s) and model(s) used: Sonnet 4.6

…figPolicy (#7477)  ## Summary  Documents the ECK 3.5 `variablesFrom` field in StackConfigPolicy, which allows externalising environment-specific values into ConfigMaps or Secrets and referencing them as `${VAR}` expressions in policy fields, with examples and namespace restriction rules. ## Generative AI disclosure  1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [x] Yes - [ ] No Tool(s) and model(s) used: Sonnet 4.6

## Summary  Documents the ECK 3.5 `securityRoles` field in StackConfigPolicy, which allows defining custom Elasticsearch roles declaratively via `roles.yml` with hot-reload — no pod restart required. ## Generative AI disclosure  1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [x] Yes - [ ] No  Tool(s) and model(s) used: Sonnet 4.6 --------- Co-authored-by: Peter Brachwitz <peter.brachwitz@gmail.com>

…config/configRef (#7473)  ## Summary  Extends the AutoOps data collection page with an ECK tab showing how to configure the AutoOps agent collector via `spec.config` (inline YAML) or `spec.configRef` (Secret reference) on `AutoOpsAgentPolicy`, replacing the manual file-editing approach for ECK users. ## Generative AI disclosure  1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [x] Yes - [ ] No Tool(s) and model(s) used: Sonnet 4.6

…s and add Fleet Server mTLS page (#7474)  ## Summary  Expands the Elasticsearch client certificate authentication docs to cover all ECK 3.5 stack components (APM, Beats, Logstash, Enterprise Search, Maps, Agent, Fleet Server) with per-component custom cert examples and known limitations, and adds a dedicated Fleet Server mTLS page. ## Generative AI disclosure  1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [x] Yes - [ ] No Tool(s) and model(s) used: Sonnet 4.6

…icsearch (#7475)  ## Summary  Documents the opt-in file-based secure settings hot-reload for Elasticsearch 9.5+ on ECK 3.5, covering the annotation, compatible settings, and the important caveat about startup-required settings. ## Generative AI disclosure  1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [x] Yes - [ ] No Tool(s) and model(s) used: Sonnet 4.6

github-actions · 2026-07-27T14:54:25Z

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

github-actions · 2026-07-27T15:03:29Z

🔍 Preview links for changed docs

Elastic Docs Style Checker (Vale)

Summary: 5 warnings, 5 suggestions found

⚠️ Warnings (5): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md	96	Elastic.Spelling	'Offboarding' is a possible misspelling.
deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md	98	Elastic.Spelling	'offboard' is a possible misspelling.
deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md	105	Elastic.Spelling	'Offboarding' is a possible misspelling.
deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md	118	Elastic.Spelling	'offboarded' is a possible misspelling.
deploy-manage/license/manage-your-license-in-eck.md	101	Elastic.Spelling	'offboarded' is a possible misspelling.

💡 Suggestions (5): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md	36	Elastic.WordChoice	Consider using 'deactivates, deselects, hides, turns off, makes unavailable' instead of 'disables', unless the term is in the UI.
deploy-manage/monitor/autoops/autoops-disable-metrics-collection.md	17	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
deploy-manage/security/k8s-es-client-certificate-auth.md	53	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
deploy-manage/security/k8s-fleet-server-client-certificate-auth.md	46	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
deploy-manage/security/k8s-fleet-server-client-certificate-auth.md	84	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'Disable', unless the term is in the UI.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

shainaraskas

A few comments, scoped to changes not yet reviewed/approved by writers. nothing significantly blocking - just good to clean up

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

…on.md Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

…on.md Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

…uth.md

eedugon

A lot of new and useful features in this release, great work!

I've shared a few comments. If you feel any of them is too big for a last-minute update we can create a follow up issue in docs-content-internal for a later update.

eedugon · 2026-07-28T08:06:22Z

+
+# Pause orchestration on ECK [k8s-pause-orchestration]
+
+During maintenance windows, such as draining {{k8s}} nodes or applying infrastructure changes, you can temporarily prevent ECK from applying spec changes to your Elastic resources. The `eck.k8s.elastic.co/pause-orchestration` annotation lets you freeze spec-driven orchestration on any ECK-managed resource while ECK continues essential maintenance tasks such as certificate rotation and health monitoring (see [What continues and what pauses](#k8s-pause-orchestration-behaviour)).


Is there any way to pause orchestration of all resources without applying the annotation individually to all resources?

If so it would be great to explain it somewhere in the section. Otherwise I think we are fine without explicitly saying it, your call :)

eedugon · 2026-07-28T08:22:10Z

+kubectl annotate --overwrite elastic --all $ANNOTATION
+
+# Pause all resources in all of the namespaces:
+for NS in $(kubectl get ns -o=custom-columns='NAME:.metadata.name' --no-headers); do kubectl annotate --overwrite elastic --all $ANNOTATION -n $NS; done


Maybe this trick could be added to the document that describes pausing orchestration too. It relates with one of my previous comments.

Co-authored-by: Edu González de la Herrán <25320357+eedugon@users.noreply.github.com>

moukoublen and others added 7 commits July 14, 2026 17:23

moukoublen requested a review from a team as a code owner July 27, 2026 14:53

moukoublen requested a review from shainaraskas July 27, 2026 14:57

Merge branch 'main' into eck-3.5.0

4690f19

moukoublen assigned moukoublen and pkoutsovasilis Jul 27, 2026

moukoublen requested a review from pebrc July 27, 2026 15:03

github-actions Bot deployed to docs-preview July 27, 2026 15:06 View deployment

moukoublen added 3 commits July 27, 2026 18:10

Add documentation for label-based discovery

013667f

replace vs. with versus

64153cc

fix warning about inline {applies_to}

daa3065

github-actions Bot deployed to docs-preview July 27, 2026 15:24 View deployment

shainaraskas approved these changes Jul 27, 2026

View reviewed changes

shainaraskas reviewed Jul 27, 2026

View reviewed changes

Comment thread deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md Outdated

moukoublen and others added 6 commits July 27, 2026 20:28

Update deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md

e45fcf1

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md

2f9d60f

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md

041aa1f

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md

cc334fd

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md

dac9eec

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md

c2b8a0c

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

github-actions Bot deployed to docs-preview July 27, 2026 17:35 View deployment

moukoublen and others added 15 commits July 27, 2026 23:09

Update deploy-manage/monitor/autoops/autoops-disable-metrics-collecti…

3dc0b31

…on.md Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/security/k8s-es-client-certificate-auth.md

6c08fd0

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/security/k8s-es-client-certificate-auth.md

f9ab838

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/security/k8s-es-client-certificate-auth.md

ddc6de2

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/security/k8s-es-client-certificate-auth.md

52f0010

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/security/k8s-es-client-certificate-auth.md

84745e6

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/deploy/cloud-on-k8s/configure-eck.md

c6da208

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/security/k8s-es-client-certificate-auth.md

b4969ac

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/deploy/cloud-on-k8s/configure-eck.md

473a365

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/deploy/cloud-on-k8s/install-using-helm-chart.md

a056adb

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/deploy/cloud-on-k8s/required-rbac-permissions.md

d8f4de5

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/license/manage-your-license-in-eck.md

74809e6

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md

f46d3b6

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md

7d89fb2

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md

3efea24

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

github-actions Bot deployed to docs-preview July 27, 2026 20:23 View deployment

moukoublen and others added 3 commits July 28, 2026 09:37

Update deploy-manage/monitor/autoops/autoops-disable-metrics-collecti…

fae4918

…on.md Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/monitor/autoops/autoops-disable-metrics-collecti…

484891f

…on.md Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update deploy-manage/security/k8s-es-client-certificate-auth.md

d47685b

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

github-actions Bot deployed to docs-preview July 28, 2026 06:42 View deployment

fix eck bullets in deploy-manage/security/k8s-es-client-certificate-a…

74f9287

…uth.md

github-actions Bot deployed to docs-preview July 28, 2026 06:50 View deployment

reorder dynamic namespace doc

873adff

github-actions Bot deployed to docs-preview July 28, 2026 07:10 View deployment

eedugon approved these changes Jul 28, 2026

View reviewed changes

moukoublen and others added 2 commits July 28, 2026 11:30

Update deploy-manage/deploy/cloud-on-k8s/configure-eck.md

b887158

Co-authored-by: Edu González de la Herrán <25320357+eedugon@users.noreply.github.com>

Update deploy-manage/deploy/cloud-on-k8s/dynamic-namespace-handling.md

aa1c78e

Co-authored-by: Edu González de la Herrán <25320357+eedugon@users.noreply.github.com>

github-actions Bot deployed to docs-preview July 28, 2026 08:34 View deployment

add trust configuration note for custom client certificates

ca9cbf7

github-actions Bot deployed to docs-preview July 28, 2026 09:19 View deployment


		# Pause orchestration on ECK [k8s-pause-orchestration]

		During maintenance windows, such as draining {{k8s}} nodes or applying infrastructure changes, you can temporarily prevent ECK from applying spec changes to your Elastic resources. The `eck.k8s.elastic.co/pause-orchestration` annotation lets you freeze spec-driven orchestration on any ECK-managed resource while ECK continues essential maintenance tasks such as certificate rotation and health monitoring (see [What continues and what pauses](#k8s-pause-orchestration-behaviour)).

Uh oh!

Conversation

moukoublen commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 27, 2026

Elastic Docs AI PR menu

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Elastic Docs Style Checker (Vale)

Uh oh!

shainaraskas left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

eedugon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

eedugon Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

eedugon Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

moukoublen commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading

shainaraskas left a comment •

edited

Loading