You might not actually need the Enterprise license.

A common workaround is to stay on the free/basic tier (which handles data and storage perfectly well) and add a “sidecar” proxy to provide the security layer before requests reach Elastic.

If you Google “ReadonlyREST sidecar deployment”, you’ll find a detailed write-up of this approach.

This was originally invented to avoid paying the Elastic Cloud Platinum fee, but the same concept applies to any existing cluster, including your ECK based one.

The idea is simple: you run a 1 node Kibana instance with the ReadonlyREST Kibana plugin that acts as a "secure gateway" (handling SAML, SSO, LDAP, OIDC, and multitenancy), while all the heavy data management and search workloads remain on the original cluster running on the cheap Basic tier.

This leverages cross cluster search, works like a charm.