From 0b1e7c7557e6332ec46c0e1aa5d2b37582f6c4a0 Mon Sep 17 00:00:00 2001
From: shainaraskas <shaina.raskas@elastic.co>
Date: Tue, 23 Dec 2025 11:50:57 -0500
Subject: [PATCH 1/8] [Docs] Increase vm.max_map_count suggested value

---
 .../elasticsearch/virtual-memory.asciidoc                   | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc b/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
index 6a90d6a5dd..9b61c9c8a6 100644
--- a/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
+++ b/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
@@ -9,9 +9,11 @@ endif::[]
 = Virtual memory
 
 By default, Elasticsearch uses memory mapping (`mmap`) to efficiently access indices.
-Usually, default values for virtual address space on Linux distributions are too low for Elasticsearch to work properly, which may result in out-of-memory exceptions. This is why link:k8s-quickstart.html[the quickstart example] disables `mmap` through the `node.store.allow_mmap: false` setting. For production workloads, it is strongly recommended to increase the kernel setting `vm.max_map_count` to `262144` and leave `node.store.allow_mmap` unset.
+Default values for virtual address space on Linux distributions can be too low for Elasticsearch to work properly, which may result in out-of-memory exceptions. This is why link:k8s-quickstart.html[the quickstart example] disables `mmap` through the `node.store.allow_mmap: false` setting. For production workloads, we recommend that you increase the kernel setting `vm.max_map_count` to `1048576` and leave `node.store.allow_mmap` unset.
 
-The kernel setting `vm.max_map_count=262144` can be set on the host directly, by a dedicated init container which must be privileged, or a dedicated Daemonset.
+The kernel setting `vm.max_map_count=1048576` can be set on the host directly, by a dedicated init container which must be privileged, or a dedicated Daemonset.
+
+IMPORTANT: For {{es}} version 8.16 and later, set the `vm.max_map_count` kernel setting to `1048576`; for {{es}} version 8.15 and earlier, set `vm.max_map_count` to `262144`.
 
 For more information, check the Elasticsearch documentation on
 link:https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html[Virtual memory].

From c2991c2c21f0bfebebb0e4408b2f8de10b158902 Mon Sep 17 00:00:00 2001
From: shainaraskas <shaina.raskas@elastic.co>
Date: Tue, 30 Dec 2025 11:25:25 -0500
Subject: [PATCH 2/8] fix values in examples and recipes

---
 config/recipes/autopilot/elasticsearch.yaml               | 4 ++--
 .../recipes/autopilot/fleet-kubernetes-integration.yaml   | 4 ++--
 config/samples/elasticsearch/elasticsearch.yaml           | 2 +-
 .../charts/eck-elasticsearch/examples/hot-warm-cold.yaml  | 8 ++++----
 .../examples/ingress/elasticsearch-ingress-aks.yaml       | 2 +-
 .../examples/ingress/elasticsearch-ingress-eks-alb.yaml   | 2 +-
 .../examples/ingress/elasticsearch-ingress-eks-nlb.yaml   | 2 +-
 .../examples/ingress/elasticsearch-ingress-gke.yaml       | 2 +-
 deploy/eck-stack/charts/eck-elasticsearch/values.yaml     | 4 ++--
 .../charts/eck-kibana/examples/ingress/kibana-eks.yaml    | 2 +-
 deploy/eck-stack/examples/agent/fleet-agents.yaml         | 2 +-
 deploy/eck-stack/examples/apm-server/basic.yaml           | 2 +-
 .../apm-server/jaeger-with-http-configuration.yaml        | 2 +-
 deploy/eck-stack/examples/beats/metricbeat_hosts.yaml     | 2 +-
 .../eck-stack/examples/custom-elasticsearch-kibana.yaml   | 2 +-
 .../eck-stack/examples/elasticsearch/hot-warm-cold.yaml   | 8 ++++----
 .../elasticsearch/ingress/elasticsearch-ingress-gke.yaml  | 2 +-
 deploy/eck-stack/examples/enterprise-search/basic.yaml    | 2 +-
 .../enterprise-search/with-custom-configuration.yaml      | 2 +-
 deploy/eck-stack/examples/kibana/ingress/kibana-gke.yaml  | 2 +-
 deploy/eck-stack/examples/logstash/basic-eck.yaml         | 2 +-
 docs/advanced-topics/gke-autopilot.asciidoc               | 2 +-
 .../elasticsearch/virtual-memory.asciidoc                 | 6 +++---
 23 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/config/recipes/autopilot/elasticsearch.yaml b/config/recipes/autopilot/elasticsearch.yaml
index e02333c217..fef18cee37 100644
--- a/config/recipes/autopilot/elasticsearch.yaml
+++ b/config/recipes/autopilot/elasticsearch.yaml
@@ -30,7 +30,7 @@ spec:
           securityContext:
             privileged: true
             runAsUser: 0
-          command: ['/usr/local/bin/bash', '-e', '-c', 'echo 262144 > /proc/sys/vm/max_map_count']
+          command: ['/usr/local/bin/bash', '-e', '-c', 'echo 1048576 > /proc/sys/vm/max_map_count']
       containers:
         - name: sleep
           image: docker.io/bash:5.2.15
@@ -60,7 +60,7 @@ spec:
               cpu: 500m
         initContainers:
         - name: max-map-count-check
-          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 262144 ]; then exit 0; fi; sleep 1; done"]
+          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 1048576 ]; then exit 0; fi; sleep 1; done"]
           resources:
             requests:
               memory: 16Mi
diff --git a/config/recipes/autopilot/fleet-kubernetes-integration.yaml b/config/recipes/autopilot/fleet-kubernetes-integration.yaml
index d1d95c1671..fd29c1bded 100644
--- a/config/recipes/autopilot/fleet-kubernetes-integration.yaml
+++ b/config/recipes/autopilot/fleet-kubernetes-integration.yaml
@@ -30,7 +30,7 @@ spec:
           securityContext:
             privileged: true
             runAsUser: 0
-          command: ['/usr/local/bin/bash', '-e', '-c', 'echo 262144 > /proc/sys/vm/max_map_count']
+          command: ['/usr/local/bin/bash', '-e', '-c', 'echo 1048576 > /proc/sys/vm/max_map_count']
       containers:
         - name: sleep
           image: docker.io/bash:5.2.15
@@ -60,7 +60,7 @@ spec:
               cpu: 500m
         initContainers:
         - name: max-map-count-check
-          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 262144 ]; then exit 0; fi; sleep 1; done"]
+          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 1048576 ]; then exit 0; fi; sleep 1; done"]
           resources:
             requests:
               memory: 16Mi
diff --git a/config/samples/elasticsearch/elasticsearch.yaml b/config/samples/elasticsearch/elasticsearch.yaml
index 45da21c331..8cdb0e210a 100644
--- a/config/samples/elasticsearch/elasticsearch.yaml
+++ b/config/samples/elasticsearch/elasticsearch.yaml
@@ -32,7 +32,7 @@ spec:
         #   securityContext:
         #     privileged: true
         #     runAsUser: 0
-        #   command: ['sh', '-c', 'sysctl -w vm.max_map_count=262144']
+        #   command: ['sh', '-c', 'sysctl -w vm.max_map_count=1048576']
         ###
         # uncomment the line below if you are using a service mesh such as linkerd2 that uses service account tokens for pod identification.
         # automountServiceAccountToken: true
diff --git a/deploy/eck-stack/charts/eck-elasticsearch/examples/hot-warm-cold.yaml b/deploy/eck-stack/charts/eck-elasticsearch/examples/hot-warm-cold.yaml
index 4eb99e60eb..9e591275de 100644
--- a/deploy/eck-stack/charts/eck-elasticsearch/examples/hot-warm-cold.yaml
+++ b/deploy/eck-stack/charts/eck-elasticsearch/examples/hot-warm-cold.yaml
@@ -5,7 +5,7 @@ nodeSets:
   config:
     node.roles: ["master"]
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
     #
@@ -54,7 +54,7 @@ nodeSets:
   config:
     node.roles: ["data_hot", "data_content", "ingest"]
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
     #
@@ -103,7 +103,7 @@ nodeSets:
   config:
     node.roles: ["data_warm"]
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
     #
@@ -152,7 +152,7 @@ nodeSets:
   config:
     node.roles: ["data_cold"]
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
     #
diff --git a/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-aks.yaml b/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-aks.yaml
index 0ca310c34b..6c7bbe6643 100644
--- a/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-aks.yaml
+++ b/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-aks.yaml
@@ -18,7 +18,7 @@ nodeSets:
 - name: default
   count: 3
   # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
   # and leave node.store.allow_mmap unset.
   # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
   #
diff --git a/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-alb.yaml b/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-alb.yaml
index d3cc4041ec..00d982ad9f 100644
--- a/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-alb.yaml
+++ b/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-alb.yaml
@@ -29,7 +29,7 @@ nodeSets:
 - name: default
   count: 3
   # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
   # and leave node.store.allow_mmap unset.
   # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
   #
diff --git a/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-nlb.yaml b/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-nlb.yaml
index 3809e871cf..7d9ffae66b 100644
--- a/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-nlb.yaml
+++ b/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-nlb.yaml
@@ -19,7 +19,7 @@ nodeSets:
 - name: default
   count: 3
   # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
   # and leave node.store.allow_mmap unset.
   # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
   #
diff --git a/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-gke.yaml b/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-gke.yaml
index 3adbd29c0c..d7c6a2cb86 100644
--- a/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-gke.yaml
+++ b/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-gke.yaml
@@ -23,7 +23,7 @@ nodeSets:
 - name: default
   count: 3
   # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
   # and leave node.store.allow_mmap unset.
   # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
   #
diff --git a/deploy/eck-stack/charts/eck-elasticsearch/values.yaml b/deploy/eck-stack/charts/eck-elasticsearch/values.yaml
index 5826cc7979..1050289f83 100644
--- a/deploy/eck-stack/charts/eck-elasticsearch/values.yaml
+++ b/deploy/eck-stack/charts/eck-elasticsearch/values.yaml
@@ -164,7 +164,7 @@ nodeSets:
   count: 1
   config:
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
     #
@@ -260,7 +260,7 @@ nodeSets:
     # - command:
     #   - sh
     #   - "-c"
-    #   - sysctl -w vm.max_map_count=262144
+    #   - sysctl -w vm.max_map_count=1048576
     #   name: sysctl
     #   securityContext:
     #     privileged: true
diff --git a/deploy/eck-stack/charts/eck-kibana/examples/ingress/kibana-eks.yaml b/deploy/eck-stack/charts/eck-kibana/examples/ingress/kibana-eks.yaml
index c5f2f43b53..e49390fd8b 100644
--- a/deploy/eck-stack/charts/eck-kibana/examples/ingress/kibana-eks.yaml
+++ b/deploy/eck-stack/charts/eck-kibana/examples/ingress/kibana-eks.yaml
@@ -40,7 +40,7 @@ nodeSets:
 - name: default
   count: 3
   # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
   # and leave node.store.allow_mmap unset.
   # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
   #
diff --git a/deploy/eck-stack/examples/agent/fleet-agents.yaml b/deploy/eck-stack/examples/agent/fleet-agents.yaml
index 4358b6f604..922f337411 100644
--- a/deploy/eck-stack/examples/agent/fleet-agents.yaml
+++ b/deploy/eck-stack/examples/agent/fleet-agents.yaml
@@ -10,7 +10,7 @@ eck-elasticsearch:
   - name: default
     count: 3
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
     #
diff --git a/deploy/eck-stack/examples/apm-server/basic.yaml b/deploy/eck-stack/examples/apm-server/basic.yaml
index 227b58257d..f1b3406fef 100644
--- a/deploy/eck-stack/examples/apm-server/basic.yaml
+++ b/deploy/eck-stack/examples/apm-server/basic.yaml
@@ -10,7 +10,7 @@ eck-elasticsearch:
   - name: default
     count: 3
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
     #
diff --git a/deploy/eck-stack/examples/apm-server/jaeger-with-http-configuration.yaml b/deploy/eck-stack/examples/apm-server/jaeger-with-http-configuration.yaml
index b694955ff3..dcf03b1951 100644
--- a/deploy/eck-stack/examples/apm-server/jaeger-with-http-configuration.yaml
+++ b/deploy/eck-stack/examples/apm-server/jaeger-with-http-configuration.yaml
@@ -10,7 +10,7 @@ eck-elasticsearch:
   - name: default
     count: 3
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
     #
diff --git a/deploy/eck-stack/examples/beats/metricbeat_hosts.yaml b/deploy/eck-stack/examples/beats/metricbeat_hosts.yaml
index 7529c55336..0dd3826142 100644
--- a/deploy/eck-stack/examples/beats/metricbeat_hosts.yaml
+++ b/deploy/eck-stack/examples/beats/metricbeat_hosts.yaml
@@ -14,7 +14,7 @@ eck-elasticsearch:
     count: 3
     config:
       # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
       # and leave node.store.allow_mmap unset.
       # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
       #
diff --git a/deploy/eck-stack/examples/custom-elasticsearch-kibana.yaml b/deploy/eck-stack/examples/custom-elasticsearch-kibana.yaml
index 081f585137..020060e1a4 100644
--- a/deploy/eck-stack/examples/custom-elasticsearch-kibana.yaml
+++ b/deploy/eck-stack/examples/custom-elasticsearch-kibana.yaml
@@ -13,7 +13,7 @@ eck-elasticsearch:
     count: 1
     config:
       # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
       # and leave node.store.allow_mmap unset.
       # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
       #
diff --git a/deploy/eck-stack/examples/elasticsearch/hot-warm-cold.yaml b/deploy/eck-stack/examples/elasticsearch/hot-warm-cold.yaml
index 919cb4c7b2..2fba35fc7e 100644
--- a/deploy/eck-stack/examples/elasticsearch/hot-warm-cold.yaml
+++ b/deploy/eck-stack/examples/elasticsearch/hot-warm-cold.yaml
@@ -6,7 +6,7 @@ eck-elasticsearch:
     config:
       node.roles: ["master"]
       # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
       # and leave node.store.allow_mmap unset.
       # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
       #
@@ -55,7 +55,7 @@ eck-elasticsearch:
     config:
       node.roles: ["data_hot", "data_content", "ingest"]
       # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
       # and leave node.store.allow_mmap unset.
       # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
       #
@@ -104,7 +104,7 @@ eck-elasticsearch:
     config:
       node.roles: ["data_warm"]
       # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
       # and leave node.store.allow_mmap unset.
       # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
       #
@@ -153,7 +153,7 @@ eck-elasticsearch:
     config:
       node.roles: ["data_cold"]
       # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
       # and leave node.store.allow_mmap unset.
       # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
       #
diff --git a/deploy/eck-stack/examples/elasticsearch/ingress/elasticsearch-ingress-gke.yaml b/deploy/eck-stack/examples/elasticsearch/ingress/elasticsearch-ingress-gke.yaml
index 0ca2e8a591..4b23a06ca0 100644
--- a/deploy/eck-stack/examples/elasticsearch/ingress/elasticsearch-ingress-gke.yaml
+++ b/deploy/eck-stack/examples/elasticsearch/ingress/elasticsearch-ingress-gke.yaml
@@ -27,7 +27,7 @@ eck-elasticsearch:
   - name: default
     count: 3
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
     #
diff --git a/deploy/eck-stack/examples/enterprise-search/basic.yaml b/deploy/eck-stack/examples/enterprise-search/basic.yaml
index aeb61b061d..5e0e1f6f02 100644
--- a/deploy/eck-stack/examples/enterprise-search/basic.yaml
+++ b/deploy/eck-stack/examples/enterprise-search/basic.yaml
@@ -10,7 +10,7 @@ eck-elasticsearch:
   - name: default
     count: 3
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
     #
diff --git a/deploy/eck-stack/examples/enterprise-search/with-custom-configuration.yaml b/deploy/eck-stack/examples/enterprise-search/with-custom-configuration.yaml
index a7c3ad49cc..5413e93317 100644
--- a/deploy/eck-stack/examples/enterprise-search/with-custom-configuration.yaml
+++ b/deploy/eck-stack/examples/enterprise-search/with-custom-configuration.yaml
@@ -10,7 +10,7 @@ eck-elasticsearch:
   - name: default
     count: 3
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
     #
diff --git a/deploy/eck-stack/examples/kibana/ingress/kibana-gke.yaml b/deploy/eck-stack/examples/kibana/ingress/kibana-gke.yaml
index 339a7a578a..52a6e7708b 100644
--- a/deploy/eck-stack/examples/kibana/ingress/kibana-gke.yaml
+++ b/deploy/eck-stack/examples/kibana/ingress/kibana-gke.yaml
@@ -35,7 +35,7 @@ eck-elasticsearch:
   - name: default
     count: 3
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
     #
diff --git a/deploy/eck-stack/examples/logstash/basic-eck.yaml b/deploy/eck-stack/examples/logstash/basic-eck.yaml
index 00f0b94f9e..969b87777f 100644
--- a/deploy/eck-stack/examples/logstash/basic-eck.yaml
+++ b/deploy/eck-stack/examples/logstash/basic-eck.yaml
@@ -5,7 +5,7 @@ eck-elasticsearch:
     count: 3
     config:
       # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
       # and leave node.store.allow_mmap unset.
       # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
       #
diff --git a/docs/advanced-topics/gke-autopilot.asciidoc b/docs/advanced-topics/gke-autopilot.asciidoc
index 8041e90bf4..b8e4013d92 100644
--- a/docs/advanced-topics/gke-autopilot.asciidoc
+++ b/docs/advanced-topics/gke-autopilot.asciidoc
@@ -58,7 +58,7 @@ spec:
         # Do not use this if setting config.node.store.allow_mmap: false
         initContainers:
         - name: max-map-count-check
-          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 262144 ]; then exit 0; fi; sleep 1; done"]
+          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 1048576 ]; then exit 0; fi; sleep 1; done"]
 EOF
 ----
 
diff --git a/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc b/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
index 9b61c9c8a6..d7b5814bc1 100644
--- a/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
+++ b/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
@@ -53,7 +53,7 @@ spec:
           securityContext:
             privileged: true
             runAsUser: 0
-          command: ['sh', '-c', 'sysctl -w vm.max_map_count=262144']
+          command: ['sh', '-c', 'sysctl -w vm.max_map_count=1048576']
 EOF
 ----
 
@@ -91,7 +91,7 @@ spec:
           securityContext:
             privileged: true
             runAsUser: 0
-          command: ['/usr/local/bin/bash', '-e', '-c', 'echo 262144 > /proc/sys/vm/max_map_count']
+          command: ['/usr/local/bin/bash', '-e', '-c', 'echo 1048576 > /proc/sys/vm/max_map_count']
       containers:
         - name: sleep
           image: docker.io/bash:5.2.21
@@ -123,6 +123,6 @@ spec:
         # Do not use this if setting config.node.store.allow_mmap: false
         initContainers:
         - name: max-map-count-check
-          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 262144 ]; then exit 0; fi; sleep 1; done"]
+          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 1048576 ]; then exit 0; fi; sleep 1; done"]
 EOF
 ----

From 575b7355e4dcca2cbaca3cea3fbdb1bcfc644c81 Mon Sep 17 00:00:00 2001
From: shainaraskas <shaina.raskas@elastic.co>
Date: Wed, 31 Dec 2025 12:04:17 -0500
Subject: [PATCH 3/8] gke autopilot fixes

---
 config/recipes/autopilot/elasticsearch.yaml           |  4 ++--
 .../autopilot/fleet-kubernetes-integration.yaml       |  4 ++--
 docs/advanced-topics/gke-autopilot.asciidoc           |  2 +-
 .../elasticsearch/virtual-memory.asciidoc             | 11 ++++++++---
 4 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/config/recipes/autopilot/elasticsearch.yaml b/config/recipes/autopilot/elasticsearch.yaml
index fef18cee37..e02333c217 100644
--- a/config/recipes/autopilot/elasticsearch.yaml
+++ b/config/recipes/autopilot/elasticsearch.yaml
@@ -30,7 +30,7 @@ spec:
           securityContext:
             privileged: true
             runAsUser: 0
-          command: ['/usr/local/bin/bash', '-e', '-c', 'echo 1048576 > /proc/sys/vm/max_map_count']
+          command: ['/usr/local/bin/bash', '-e', '-c', 'echo 262144 > /proc/sys/vm/max_map_count']
       containers:
         - name: sleep
           image: docker.io/bash:5.2.15
@@ -60,7 +60,7 @@ spec:
               cpu: 500m
         initContainers:
         - name: max-map-count-check
-          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 1048576 ]; then exit 0; fi; sleep 1; done"]
+          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 262144 ]; then exit 0; fi; sleep 1; done"]
           resources:
             requests:
               memory: 16Mi
diff --git a/config/recipes/autopilot/fleet-kubernetes-integration.yaml b/config/recipes/autopilot/fleet-kubernetes-integration.yaml
index fd29c1bded..d1d95c1671 100644
--- a/config/recipes/autopilot/fleet-kubernetes-integration.yaml
+++ b/config/recipes/autopilot/fleet-kubernetes-integration.yaml
@@ -30,7 +30,7 @@ spec:
           securityContext:
             privileged: true
             runAsUser: 0
-          command: ['/usr/local/bin/bash', '-e', '-c', 'echo 1048576 > /proc/sys/vm/max_map_count']
+          command: ['/usr/local/bin/bash', '-e', '-c', 'echo 262144 > /proc/sys/vm/max_map_count']
       containers:
         - name: sleep
           image: docker.io/bash:5.2.15
@@ -60,7 +60,7 @@ spec:
               cpu: 500m
         initContainers:
         - name: max-map-count-check
-          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 1048576 ]; then exit 0; fi; sleep 1; done"]
+          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 262144 ]; then exit 0; fi; sleep 1; done"]
           resources:
             requests:
               memory: 16Mi
diff --git a/docs/advanced-topics/gke-autopilot.asciidoc b/docs/advanced-topics/gke-autopilot.asciidoc
index b8e4013d92..8041e90bf4 100644
--- a/docs/advanced-topics/gke-autopilot.asciidoc
+++ b/docs/advanced-topics/gke-autopilot.asciidoc
@@ -58,7 +58,7 @@ spec:
         # Do not use this if setting config.node.store.allow_mmap: false
         initContainers:
         - name: max-map-count-check
-          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 1048576 ]; then exit 0; fi; sleep 1; done"]
+          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 262144 ]; then exit 0; fi; sleep 1; done"]
 EOF
 ----
 
diff --git a/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc b/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
index d7b5814bc1..a404eefac3 100644
--- a/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
+++ b/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
@@ -13,7 +13,7 @@ Default values for virtual address space on Linux distributions can be too low f
 
 The kernel setting `vm.max_map_count=1048576` can be set on the host directly, by a dedicated init container which must be privileged, or a dedicated Daemonset.
 
-IMPORTANT: For {{es}} version 8.16 and later, set the `vm.max_map_count` kernel setting to `1048576`; for {{es}} version 8.15 and earlier, set `vm.max_map_count` to `262144`.
+IMPORTANT: For {{es}} version 8.16 and later, set the `vm.max_map_count` kernel setting to `1048576`; for {{es}} version 8.15 and earlier, set `vm.max_map_count` to `262144`. The exception is in GKE Autopilot environments, where `vm.max_map_count` must always be set to `262144`.
 
 For more information, check the Elasticsearch documentation on
 link:https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html[Virtual memory].
@@ -53,10 +53,12 @@ spec:
           securityContext:
             privileged: true
             runAsUser: 0
-          command: ['sh', '-c', 'sysctl -w vm.max_map_count=1048576']
+          command: ['sh', '-c', 'sysctl -w vm.max_map_count=1048576'] <1>
 EOF
 ----
 
+<1> In GKE Autopilot environments, `vm.max_map_count` must be set to 262144.
+
 Note that this requires the ability to run privileged containers, which is likely not the case on many secure clusters.
 
 == Using a Daemonset to set virtual memory
@@ -99,6 +101,8 @@ spec:
 EOF
 ----
 
+<1> In GKE Autopilot environments, `vm.max_map_count` must be set to 262144.
+
 To run an Elasticsearch instance that waits for the kernel setting to be in place:
 
 [source,yaml,subs="attributes,+macros"]
@@ -123,6 +127,7 @@ spec:
         # Do not use this if setting config.node.store.allow_mmap: false
         initContainers:
         - name: max-map-count-check
-          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 1048576 ]; then exit 0; fi; sleep 1; done"]
+          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 1048576 ]; then exit 0; fi; sleep 1; done"] <1>
 EOF
 ----
+<1> In GKE Autopilot environments, `vm.max_map_count` must be set to 262144.

From 8bfd884a876eab01855138f1f6bc714d9e533064 Mon Sep 17 00:00:00 2001
From: shainaraskas <shaina.raskas@elastic.co>
Date: Tue, 6 Jan 2026 14:53:37 -0500
Subject: [PATCH 4/8] fix annotations

---
 .../elasticsearch/virtual-memory.asciidoc                      | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc b/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
index a404eefac3..94d03c93b4 100644
--- a/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
+++ b/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
@@ -93,7 +93,7 @@ spec:
           securityContext:
             privileged: true
             runAsUser: 0
-          command: ['/usr/local/bin/bash', '-e', '-c', 'echo 1048576 > /proc/sys/vm/max_map_count']
+          command: ['/usr/local/bin/bash', '-e', '-c', 'echo 1048576 > /proc/sys/vm/max_map_count'] <1>
       containers:
         - name: sleep
           image: docker.io/bash:5.2.21
@@ -130,4 +130,5 @@ spec:
           command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 1048576 ]; then exit 0; fi; sleep 1; done"] <1>
 EOF
 ----
+
 <1> In GKE Autopilot environments, `vm.max_map_count` must be set to 262144.

From 6df8693a0f5d508566c097ed1872f3ddbb688862 Mon Sep 17 00:00:00 2001
From: shainaraskas <shaina.raskas@elastic.co>
Date: Wed, 7 Jan 2026 15:04:48 -0500
Subject: [PATCH 5/8] small clarification

---
 .../elasticsearch/virtual-memory.asciidoc                       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc b/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
index 94d03c93b4..a712bfab85 100644
--- a/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
+++ b/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
@@ -13,7 +13,7 @@ Default values for virtual address space on Linux distributions can be too low f
 
 The kernel setting `vm.max_map_count=1048576` can be set on the host directly, by a dedicated init container which must be privileged, or a dedicated Daemonset.
 
-IMPORTANT: For {{es}} version 8.16 and later, set the `vm.max_map_count` kernel setting to `1048576`; for {{es}} version 8.15 and earlier, set `vm.max_map_count` to `262144`. The exception is in GKE Autopilot environments, where `vm.max_map_count` must always be set to `262144`.
+IMPORTANT: For {{es}} version 8.16 and later, set the `vm.max_map_count` kernel setting to `1048576`; for {{es}} version 8.15 and earlier, set `vm.max_map_count` to `262144`. The exception is in GKE Autopilot environments, where `vm.max_map_count` must always be set to `262144`. This is because any custom DaemonSet must match the DaemonSet pre-approved by Google.
 
 For more information, check the Elasticsearch documentation on
 link:https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html[Virtual memory].

From 3ca1bcafc5c0195ba55636d2965633071c594efd Mon Sep 17 00:00:00 2001
From: shainaraskas <shaina.raskas@elastic.co>
Date: Wed, 7 Jan 2026 15:25:45 -0500
Subject: [PATCH 6/8] did I fix it

---
 .../elasticsearch/virtual-memory.asciidoc                 | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc b/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
index a712bfab85..6d6c3565cb 100644
--- a/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
+++ b/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
@@ -13,7 +13,7 @@ Default values for virtual address space on Linux distributions can be too low f
 
 The kernel setting `vm.max_map_count=1048576` can be set on the host directly, by a dedicated init container which must be privileged, or a dedicated Daemonset.
 
-IMPORTANT: For {{es}} version 8.16 and later, set the `vm.max_map_count` kernel setting to `1048576`; for {{es}} version 8.15 and earlier, set `vm.max_map_count` to `262144`. The exception is in GKE Autopilot environments, where `vm.max_map_count` must always be set to `262144`. This is because any custom DaemonSet must match the DaemonSet pre-approved by Google.
+IMPORTANT: For {{es}} version 8.16 and later, set the `vm.max_map_count` kernel setting to `1048576`; for {{es}} version 8.15 and earlier, set `vm.max_map_count` to `262144`. The exception is in GKE Autopilot environments, where `vm.max_map_count` must always be set to `262144`. This is because any custom DaemonSet in GKE Autopilot must match the DaemonSet pre-approved by Google.
 
 For more information, check the Elasticsearch documentation on
 link:https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html[Virtual memory].
@@ -34,7 +34,7 @@ spec:
 == Using an Init Container to set virtual memory
 
 To add an init container that changes the host kernel setting before your Elasticsearch container starts, you can use the following example Elasticsearch spec:
-[source,yaml,subs="attributes,+macros"]
+[source,yaml,subs="attributes,+macros,callouts"]
 ----
 cat $$<<$$EOF | kubectl apply -f -
 apiVersion: elasticsearch.k8s.elastic.co/{eck_crd_version}
@@ -65,7 +65,7 @@ Note that this requires the ability to run privileged containers, which is likel
 
 To use a Daemonset that changes the host kernel setting on all nodes:
 
-[source,yaml,subs="attributes,+macros"]
+[source,yaml,subs="attributes,+macros,callouts"]
 ----
 cat $$<<$$EOF | kubectl apply -n elastic-system -f -
 apiVersion: apps/v1
@@ -105,7 +105,7 @@ EOF
 
 To run an Elasticsearch instance that waits for the kernel setting to be in place:
 
-[source,yaml,subs="attributes,+macros"]
+[source,yaml,subs="attributes,+macros,callouts"]
 ----
 cat $$<<$$'EOF' | kubectl apply -f -
 apiVersion: elasticsearch.k8s.elastic.co/{eck_crd_version}

From 2bf2e709455d8f83975d61ebe51cd94cacd634e1 Mon Sep 17 00:00:00 2001
From: shainaraskas <58563081+shainaraskas@users.noreply.github.com>
Date: Thu, 8 Jan 2026 11:45:17 -0500
Subject: [PATCH 7/8] Update
 docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc

Co-authored-by: Peter Brachwitz <peter.brachwitz@elastic.co>
---
 .../elasticsearch/virtual-memory.asciidoc                       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc b/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
index 6d6c3565cb..395153cdae 100644
--- a/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
+++ b/docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc
@@ -13,7 +13,7 @@ Default values for virtual address space on Linux distributions can be too low f
 
 The kernel setting `vm.max_map_count=1048576` can be set on the host directly, by a dedicated init container which must be privileged, or a dedicated Daemonset.
 
-IMPORTANT: For {{es}} version 8.16 and later, set the `vm.max_map_count` kernel setting to `1048576`; for {{es}} version 8.15 and earlier, set `vm.max_map_count` to `262144`. The exception is in GKE Autopilot environments, where `vm.max_map_count` must always be set to `262144`. This is because any custom DaemonSet in GKE Autopilot must match the DaemonSet pre-approved by Google.
+IMPORTANT: For {{es}} version 8.16 and later, set the `vm.max_map_count` kernel setting to `1048576`; for {{es}} version 8.15 and earlier, set `vm.max_map_count` to `262144`. The exception is in GKE Autopilot environments, where `vm.max_map_count` must always be set to `262144`. This is because any privileged DaemonSet in GKE Autopilot must match the DaemonSet pre-approved by Google.
 
 For more information, check the Elasticsearch documentation on
 link:https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html[Virtual memory].

From aa2a2e3e9fbe846f90ad18153fa52912058dde9c Mon Sep 17 00:00:00 2001
From: shainaraskas <58563081+shainaraskas@users.noreply.github.com>
Date: Thu, 8 Jan 2026 15:23:30 -0500
Subject: [PATCH 8/8] Update copyright year to 2026

---
 NOTICE.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/NOTICE.txt b/NOTICE.txt
index d934eeb312..fab5243022 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -1,4 +1,4 @@
-Copyright 2018-2025 Elasticsearch BV
+Copyright 2018-2026 Elasticsearch BV
 
 This product includes software developed by The Apache Software
 Foundation (http://www.apache.org/).