Plugin installation with Istio enabled?

Elastic Orchestration Elastic Cloud on Kubernetes (ECK)
1

I am trying to get some plugins installed on my ECK cluster (v 1.1.0) using initContainers, e.g. -

        initContainers:
        - name: install-plugins
          command:
          - sh
          - -c
          - bin/elasticsearch-plugin install --verbose --batch repository-s3

I have Istio 1.4 installed on the cluster with the CNI plugin enabled, and it seems that Istio blocks initContainers from being able to establish a connection out of the cluster until the sidecar is running (which naturally, is after the initContainer should finish).

Does anyone have a workaround for this issue?

Hopefully this can be achieved without building additional containers, as this is a bit painful. Either way, this issue should be included in the documentation for ECK as there are other instructions suggesting that Istio-managed clusters are supported, but no mention that they will cause issues with the recommended plugin installation approach...

2

Due to the configuration complexity of Istio, it is difficult to cover all aspects of it in the ECK documentation. CNI is not currently included in our guide due to it being relatively new and less widely adopted. To work around the issue you are facing, you can whitelist port 443 to allow the plugin installation container to download the binaries.

---
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: hulk
spec:
  version: 7.6.2
  http:
    tls:
      selfSignedCertificate:
        disabled: true
  secureSettings:
    - secretName: gcs-credentials
  nodeSets:
  - name: default
    count: 3
    config:
      node.store.allow_mmap: false
    podTemplate:
      metadata:
        annotations:
          traffic.sidecar.istio.io/includeInboundPorts: "*"
          traffic.sidecar.istio.io/excludeOutboundPorts: "9300,443" 
          traffic.sidecar.istio.io/excludeInboundPorts: "9300"
      spec:
        initContainers:
          - name: install-plugins
            command:
              - sh
              - -c
              - |
                bin/elasticsearch-plugin install --batch repository-gcs