As I see it want to connect to external webhook service. Do I need to install my own?
No. This webhook service is auto-created by the operator at startup and is used to validate the Elasticsearch specs you submit to the API server.
You have to make sure that your k8s control-plane can reach the webhook service on port 443. See here for details Timeout when validating admission webhook unreachable · Issue #896 · elastic/cloud-on-k8s · GitHub
Alternatively you can remove the validation webhook as a workaround:
kubectl delete validatingwebhookconfigurations validating-webhook-configuration
The disadvantage of that workaround is that you lose any immediate feedback on specification errors in your Elasticsearch resources.