[Docs] Increase vm.max_map_count suggested value (attempt 2)

NOTICE.txt

@@ -1,4 +1,4 @@
-Copyright 2018-2025 Elasticsearch BV
+Copyright 2018-2026 Elasticsearch BV
 
 This product includes software developed by The Apache Software
 Foundation (http://www.apache.org/).

config/samples/elasticsearch/elasticsearch.yaml

@@ -32,7 +32,7 @@ spec:
         #   securityContext:
         #     privileged: true
         #     runAsUser: 0
-        #   command: ['sh', '-c', 'sysctl -w vm.max_map_count=262144']
+        #   command: ['sh', '-c', 'sysctl -w vm.max_map_count=1048576']
         ###
         # uncomment the line below if you are using a service mesh such as linkerd2 that uses service account tokens for pod identification.
         # automountServiceAccountToken: true

deploy/eck-stack/charts/eck-elasticsearch/examples/hot-warm-cold.yaml

@@ -5,7 +5,7 @@ nodeSets:
   config:
     node.roles: ["master"]
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
     #
@@ -54,7 +54,7 @@ nodeSets:
   config:
     node.roles: ["data_hot", "data_content", "ingest"]
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
     #
@@ -103,7 +103,7 @@ nodeSets:
   config:
     node.roles: ["data_warm"]
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
     #
@@ -152,7 +152,7 @@ nodeSets:
   config:
     node.roles: ["data_cold"]
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
     #

deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-aks.yaml

@@ -18,7 +18,7 @@ nodeSets:
 - name: default
   count: 3
   # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
   # and leave node.store.allow_mmap unset.
   # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
   #

deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-alb.yaml

@@ -29,7 +29,7 @@ nodeSets:
 - name: default
   count: 3
   # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
   # and leave node.store.allow_mmap unset.
   # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
   #

deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-nlb.yaml

@@ -19,7 +19,7 @@ nodeSets:
 - name: default
   count: 3
   # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
   # and leave node.store.allow_mmap unset.
   # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
   #

deploy/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-gke.yaml

@@ -23,7 +23,7 @@ nodeSets:
 - name: default
   count: 3
   # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
   # and leave node.store.allow_mmap unset.
   # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
   #

deploy/eck-stack/charts/eck-elasticsearch/values.yaml

@@ -164,7 +164,7 @@ nodeSets:
   count: 1
   config:
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
     #
@@ -260,7 +260,7 @@ nodeSets:
     # - command:
     #   - sh
     #   - "-c"
-    #   - sysctl -w vm.max_map_count=262144
+    #   - sysctl -w vm.max_map_count=1048576
     #   name: sysctl
     #   securityContext:
     #     privileged: true

deploy/eck-stack/charts/eck-kibana/examples/ingress/kibana-eks.yaml

@@ -40,7 +40,7 @@ nodeSets:
 - name: default
   count: 3
   # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+  # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
   # and leave node.store.allow_mmap unset.
   # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
   #

deploy/eck-stack/examples/agent/fleet-agents.yaml

@@ -10,7 +10,7 @@ eck-elasticsearch:
   - name: default
     count: 3
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
     #

deploy/eck-stack/examples/apm-server/basic.yaml

@@ -10,7 +10,7 @@ eck-elasticsearch:
   - name: default
     count: 3
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
     #

deploy/eck-stack/examples/apm-server/jaeger-with-http-configuration.yaml

@@ -10,7 +10,7 @@ eck-elasticsearch:
   - name: default
     count: 3
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
     #

deploy/eck-stack/examples/beats/metricbeat_hosts.yaml

@@ -14,7 +14,7 @@ eck-elasticsearch:
     count: 3
     config:
       # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
       # and leave node.store.allow_mmap unset.
       # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
       #

deploy/eck-stack/examples/custom-elasticsearch-kibana.yaml

@@ -13,7 +13,7 @@ eck-elasticsearch:
     count: 1
     config:
       # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
       # and leave node.store.allow_mmap unset.
       # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
       #

deploy/eck-stack/examples/elasticsearch/hot-warm-cold.yaml

@@ -6,7 +6,7 @@ eck-elasticsearch:
     config:
       node.roles: ["master"]
       # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
       # and leave node.store.allow_mmap unset.
       # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
       #
@@ -55,7 +55,7 @@ eck-elasticsearch:
     config:
       node.roles: ["data_hot", "data_content", "ingest"]
       # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
       # and leave node.store.allow_mmap unset.
       # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
       #
@@ -104,7 +104,7 @@ eck-elasticsearch:
     config:
       node.roles: ["data_warm"]
       # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
       # and leave node.store.allow_mmap unset.
       # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
       #
@@ -153,7 +153,7 @@ eck-elasticsearch:
     config:
       node.roles: ["data_cold"]
       # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
       # and leave node.store.allow_mmap unset.
       # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
       #

deploy/eck-stack/examples/elasticsearch/ingress/elasticsearch-ingress-gke.yaml

@@ -27,7 +27,7 @@ eck-elasticsearch:
   - name: default
     count: 3
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
     #

deploy/eck-stack/examples/enterprise-search/basic.yaml

@@ -10,7 +10,7 @@ eck-elasticsearch:
   - name: default
     count: 3
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
     #

deploy/eck-stack/examples/enterprise-search/with-custom-configuration.yaml

@@ -10,7 +10,7 @@ eck-elasticsearch:
   - name: default
     count: 3
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
     #

deploy/eck-stack/examples/kibana/ingress/kibana-gke.yaml

@@ -35,7 +35,7 @@ eck-elasticsearch:
   - name: default
     count: 3
     # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+    # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
     # and leave node.store.allow_mmap unset.
     # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html
     #

deploy/eck-stack/examples/logstash/basic-eck.yaml

@@ -5,7 +5,7 @@ eck-elasticsearch:
     count: 3
     config:
       # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive.
-      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144
+      # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 1048576
       # and leave node.store.allow_mmap unset.
       # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html
       #

docs/orchestrating-elastic-stack-applications/elasticsearch/virtual-memory.asciidoc

@@ -9,9 +9,11 @@ endif::[]
 = Virtual memory
 
 By default, Elasticsearch uses memory mapping (`mmap`) to efficiently access indices.
-Usually, default values for virtual address space on Linux distributions are too low for Elasticsearch to work properly, which may result in out-of-memory exceptions. This is why link:k8s-quickstart.html[the quickstart example] disables `mmap` through the `node.store.allow_mmap: false` setting. For production workloads, it is strongly recommended to increase the kernel setting `vm.max_map_count` to `262144` and leave `node.store.allow_mmap` unset.
+Default values for virtual address space on Linux distributions can be too low for Elasticsearch to work properly, which may result in out-of-memory exceptions. This is why link:k8s-quickstart.html[the quickstart example] disables `mmap` through the `node.store.allow_mmap: false` setting. For production workloads, we recommend that you increase the kernel setting `vm.max_map_count` to `1048576` and leave `node.store.allow_mmap` unset.
 
-The kernel setting `vm.max_map_count=262144` can be set on the host directly, by a dedicated init container which must be privileged, or a dedicated Daemonset.
+The kernel setting `vm.max_map_count=1048576` can be set on the host directly, by a dedicated init container which must be privileged, or a dedicated Daemonset.
+
+IMPORTANT: For {{es}} version 8.16 and later, set the `vm.max_map_count` kernel setting to `1048576`; for {{es}} version 8.15 and earlier, set `vm.max_map_count` to `262144`. The exception is in GKE Autopilot environments, where `vm.max_map_count` must always be set to `262144`. This is because any privileged DaemonSet in GKE Autopilot must match the DaemonSet pre-approved by Google. 
 
 For more information, check the Elasticsearch documentation on
 link:https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html[Virtual memory].
@@ -32,7 +34,7 @@ spec:
 == Using an Init Container to set virtual memory
 
 To add an init container that changes the host kernel setting before your Elasticsearch container starts, you can use the following example Elasticsearch spec:
-[source,yaml,subs="attributes,+macros"]
+[source,yaml,subs="attributes,+macros,callouts"]
 ----
 cat $$<<$$EOF | kubectl apply -f -
 apiVersion: elasticsearch.k8s.elastic.co/{eck_crd_version}
@@ -51,17 +53,19 @@ spec:
           securityContext:
             privileged: true
             runAsUser: 0
-          command: ['sh', '-c', 'sysctl -w vm.max_map_count=262144']
+          command: ['sh', '-c', 'sysctl -w vm.max_map_count=1048576'] <1>
 EOF
 ----
 
+<1> In GKE Autopilot environments, `vm.max_map_count` must be set to 262144.
+
 Note that this requires the ability to run privileged containers, which is likely not the case on many secure clusters.
 
 == Using a Daemonset to set virtual memory
 
 To use a Daemonset that changes the host kernel setting on all nodes:
 
-[source,yaml,subs="attributes,+macros"]
+[source,yaml,subs="attributes,+macros,callouts"]
 ----
 cat $$<<$$EOF | kubectl apply -n elastic-system -f -
 apiVersion: apps/v1
@@ -89,17 +93,19 @@ spec:
           securityContext:
             privileged: true
             runAsUser: 0
-          command: ['/usr/local/bin/bash', '-e', '-c', 'echo 262144 > /proc/sys/vm/max_map_count']
+          command: ['/usr/local/bin/bash', '-e', '-c', 'echo 1048576 > /proc/sys/vm/max_map_count'] <1>
       containers:
         - name: sleep
           image: docker.io/bash:5.2.21
           command: ['sleep', 'infinity']
 EOF
 ----
 
+<1> In GKE Autopilot environments, `vm.max_map_count` must be set to 262144.
+
 To run an Elasticsearch instance that waits for the kernel setting to be in place:
 
-[source,yaml,subs="attributes,+macros"]
+[source,yaml,subs="attributes,+macros,callouts"]
 ----
 cat $$<<$$'EOF' | kubectl apply -f -
 apiVersion: elasticsearch.k8s.elastic.co/{eck_crd_version}
@@ -121,6 +127,8 @@ spec:
         # Do not use this if setting config.node.store.allow_mmap: false
         initContainers:
         - name: max-map-count-check
-          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 262144 ]; then exit 0; fi; sleep 1; done"]
+          command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 1048576 ]; then exit 0; fi; sleep 1; done"] <1>
 EOF
 ----
+
+<1> In GKE Autopilot environments, `vm.max_map_count` must be set to 262144.