@dadoonet, the documentation says it must be in the elasticsearch.yml file:
Remote hosts have to be explicitly whitelisted in elasticsearch.yaml using the
reindex.remote.whitelistproperty. It can be set to a comma delimited list of allowed remotehostandportcombinations (e.g.otherhost:9200,another:9200,127.0.10.*:9200,localhost:*). Scheme is ignored by the whitelist - only host and port are used.
I think that's by design, that it must be hard-coded before startup.