Elasticsearch-setup-passwords

@TimV has written up how you can automate setting the passwords

Not necessarily, you can check out the Logstash's secrets keystore for example.

Yes, see PKI Client authentication for Elasticsearch