feat(elasticsearch): support version 8.19.0

[weicao]

Summary

• Fixes Elasticsearch addon should support Elasticsearch and Kibana 8.19.0 #2966.
• Add Elasticsearch 8.19.0 and Kibana 8.19.0 to the supported versions list.
• Add 8.19.0 IK/Pinyin plugin build source to the plugins Dockerfile.
• Bump the default ES companion plugin image to official apecloud/elasticsearch-plugins:0.1.1.
• Current status: reviewable. Static checks, render checks, GitHub checks, current-head provision/service smoke, and corrected plugin-covered runtime validation have passed. This is not release-ready/full-suite N=10 evidence.

Changes in this branch

• addons/elasticsearch/values.yaml: add ["8.19.0", "8.19.0", "8.19.0", false] to esVersions[major=8].minors and kibanaVersions[major=8].minors, and set image.plugin.tag to 0.1.1.
• addons/elasticsearch/plugins/Dockerfile: add 8.19.0 to the IK/Pinyin plugin version loop as build source.
• addons/elasticsearch/templates/_helpers.tpl and scripts/entrypoint.sh: use bash for runtime scripts and guard absent /etc/pki/tls.
• README.md: generated supported-version table includes Elasticsearch/Kibana 8.19.0.

Branch sync and checks

• Synced with latest origin/main on 2026-07-01 so this branch contains both the plugin image release workflow and the 8.19.0 plugin Dockerfile change.
• Current PR head: 0a359b1b62b429336fb6b54d2e06f21184b68271.
• GitHub checks on the current head are green: chart checks, shell-check, shellspec-test, pr-label-check.
• Local static checks on the current head passed: bash -n addons/elasticsearch/scripts/entrypoint.sh; changed-file git diff --check origin/main...HEAD.
• Local render check: helm template es addons/elasticsearch --set image.tag=8.19.0 --set image.kibana.tag=8.19.0 renders 8.19.0 prepare-plugins as docker.io/apecloud/elasticsearch-plugins:0.1.1.

Image availability and workflow status

• apecloud/elasticsearch:8.19.0 - Docker Registry HEAD 200, digest sha256:8eb0ee819c020d1275e7f7b82aefdea5d50014c8986bb5be64d80232b58119a5.
• apecloud/kibana:8.19.0 - Docker Registry HEAD 200, digest sha256:686b830b1e03e0567974630bdb4a651a3ce46ed368f9124a0d238340e631c785.
• First apecloud/elasticsearch-plugins:0.1.1 publication existed at index digest sha256:850a49b19da13567a7b387ee1f17e94d1925c188e5508b87e39b517f5870e37d, but runtime validation proved it lacked /plugins/8.19.0.
• Corrected workflow run from this PR branch: 28490117218, ref feature/es-8.19-support, head 0a359b1b62b429336fb6b54d2e06f21184b68271, completed success.
• Corrected DockerHub and canonical ACR plugin image index digest: sha256:f15db4ac8b3aa485955c2a4abc86773cb49b315159222eb81e1b28b406c2c203.
• Corrected platform digests: amd64 sha256:fa45d081ab6936f3e08a9fba8bb87b41bfbc4ff948a19db125e13be6ce38ad1e; arm64 sha256:61f842085625b64b6055e4c2f82a2f20798356125f6bfcd439fb79bd3e8a8048.
• Local container sanity checks against DockerHub and canonical ACR confirm /plugins/8.19.0 exists.

Provision and service-connectivity validation

Current-head smoke after the 2026-06-30 rebase, before the official 0.1.1 tag bump:

• PR head: 26a65b2d2a19fcc344f5d4ccf974e75328937d7b
• RUN_ID: 20260630-110008-82873
• Result: PASS 10 / FAIL 0 / SKIP 0, runner rc=0
• KB identity: worktree commit 304d30829cc3e32c4afd8fe02a3f9f39866276bc, controller image apecloud/kubeblocks:1.2.0-alpha.2
• Addon identity: chart elasticsearch-1.2.0-alpha.0, ServiceVersion 8.19.0, plugin image apecloud/elasticsearch-plugins:0.1.0
• Evidence tar sha256: 51fc8edf244b4dbcc84619f75e1f62ae9e8ea620ad2fcf20d9fbb8babf2e28ed
• Matrix covered single and multi cluster apply/provision, phase Running, ES health green, index/search side effect, direct Service health green, and cleanup.
• Runtime image digest observed on ES pods: apecloud/elasticsearch:8.19.0 at sha256:8eb0ee819c020d1275e7f7b82aefdea5d50014c8986bb5be64d80232b58119a5.
• Cleanup: namespace elasticsearch-test-2835 NotFound, no residual PV.

This smoke remains supporting evidence only because it did not use the official 0.1.1 plugin companion image.

Plugin-covered validation

First official 0.1.1 runtime attempt:

• PR head under test: 13a35c729d490ed2a5165248190740298218483c
• RUN_ID: 20260701-103404-90252
• Result: FAIL in plugin-covered runtime path; not a product PASS.
• Live plugin image readback: apecloud/elasticsearch-plugins:0.1.1 at index digest sha256:850a49b19da13567a7b387ee1f17e94d1925c188e5508b87e39b517f5870e37d.
• Failure: prepare-plugins image /plugins contained 6.8.23 7.10.1 7.10.2 7.7.1 7.8.1 8.1.3 8.15.5 8.8.2 and did not contain 8.19.0; elasticsearch-plugin list was empty; IK _analyze returned HTTP 400 because ik_max_word did not exist.
• Evidence tar sha256: fd079fbb9d9703d7ecbb2b8da4533df4bf12eb8927e3b5085007dfb13408ee41.

DockerHub override rerun:

• RUN_ID: 20260701-110044-17363
• Result: aborted before runtime because idc4 vcluster cannot pull DockerHub (registry-1.docker.io timeout); not a product PASS or FAIL.
• Evidence tar sha256: 485fd57f63cb90f5be19344f863732e2a65922f167f6882b62356f2f96bd592e.

Corrected ACR digest-pinned plugin-covered validation:

• PR head under test: 0a359b1b62b429336fb6b54d2e06f21184b68271
• RUN_ID: 20260701-110951-25969
• Target: es-idc4-vc (https://192.168.10.44:32425)
• KB identity: repo /Users/apecloud/work/kubeblocks/wt-304d308, commit 304d30829cc3e32c4afd8fe02a3f9f39866276bc, controller image apecloud/kubeblocks:1.2.0-alpha.2
• Addon identity: repo /Users/apecloud/work/kubeblocks-addons/wt-es-0a359b1, chart elasticsearch-1.2.0-alpha.0, Helm release elasticsearch revision 12, ServiceVersion 8.19.0
• Runtime deviation: only ComponentVersion/elasticsearch 8.19.0 prepare-plugins was patched to canonical ACR digest-pinned image apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com/apecloud/elasticsearch-plugins@sha256:f15db4ac8b3aa485955c2a4abc86773cb49b315159222eb81e1b28b406c2c203; ES/agent/exporter stayed on the existing ACR tag path. This avoids idc4 DockerHub egress timeout and stale ACR tag-cache ambiguity.
• Runner command: ./run-tests.sh -t plugin-covered -n elasticsearch-test-2835-plugin -s apelocal-hostpath-default --service-version 8.19.0 --freeze-on-fail --addons-repo /Users/apecloud/work/kubeblocks-addons/wt-es-0a359b1 --kubeblocks-repo /Users/apecloud/work/kubeblocks/wt-304d308
• Result: PASS 11 / FAIL 0 / SKIP 0, runner rc=0
• Live plugin image readback on pod es-plugin-mdit-0, init container prepare-plugins: apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com/apecloud/elasticsearch-plugins@sha256:f15db4ac8b3aa485955c2a4abc86773cb49b315159222eb81e1b28b406c2c203
• elasticsearch-plugin list: ik, pinyin
• IK analyzer proof: ik_max_word, text 我爱北京天安门, tokens include 我, 爱, 北京, 天安门, 天安, 门
• Pinyin analyzer proof: pinyin, text 中文, tokens include zhong, zw, wen
• Matrix covered single cluster apply/provision, phase Running, ES health green, index/search side effect, and direct Service health green.
• Evidence tar sha256: a40af669b7a04702eadd193c809667e33ff4b7b7e482cffe9ba170c28830fda5
• SHA256SUMS verification: all 58 items OK; SHA256SUMS own independent hash f4aae3e47c6d85e91bcc00c625f5fa4e6ecdf0c2fd60f52a67309e40759dcccf
• Cleanup: namespace elasticsearch-test-2835-plugin NotFound, no residual PV.

Earlier IDC early-signal evidence is posted in this PR comment: #2835 (comment)

Additional supporting validation

• IK/Pinyin analyzer validation with onsite built 0.1.1 plugin image: PASS, evidence sha 4031af22...; imageID sha256:8facc375.... This proved the Dockerfile build source path before the official registry image existed.
• Supporting ops evidence on addon commit 9d6d2a534f12f08924f52dac82d866243ff5caf7: VolumeExpansion N=1 reviewed PASS and same-major upgrade 8.8.2 -> 8.19.0 N=1 reviewed PASS.

Boundary

• This PR is reviewable for scoped Elasticsearch/Kibana 8.19.0 support and corrected plugin-covered validation.
• The plugin-covered runtime PASS is scoped to corrected canonical ACR digest-pinned 0.1.1; the idc4 ACR tag-cache/default mirror path remains an environment/image-cache follow-up and is not claimed as validated here.
• Not release-ready evidence, not full-suite N=10, and not a general 8.19.0 release acceptance claim.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (85c9427) to head (0a359b1).

Additional details and impacted files

@@          Coverage Diff          @@
##            main   #2835   +/-   ##
=====================================
  Coverage   0.00%   0.00%           
=====================================
  Files        137     137           
  Lines      22356   22356           
=====================================
  Misses     22356   22356           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[weicao]

ES 8.19.0 Early Signal Evidence

RUN_ID: 20250625-es8190-signal
Result: 10P / 0F / 0S
Evidence tar SHA256: 141804527368f4c2a2a514591a427e029f8c6ed0687fb4165a0de4585e104816

Pinned Identity

• KB controller: a414e31e9e4476f4ec0e59e8910d9c5e63eb47fa
• Addon: 6061b5fac25066ca0aad818530a0fc236f41a8de + bash/pki/kibana manual patches
• Chart: 1.2.0-alpha.0, serviceVersion 8.19.0
• ES image: apecloud/elasticsearch:8.19.0
• Plugins init: apecloud/elasticsearch-plugins:0.1.0 (graceful-skip, no 8.19.0 IK/Pinyin)

Test Matrix

Test	Result
apply single cluster es-single	PASS
cluster es-single phase=Running	PASS
ES health for es-single is green	PASS
ES index/search side effect for es-single	PASS
ES direct Service health for es-single is green	PASS
apply multi cluster es-multi	PASS
cluster es-multi phase=Running	PASS
ES health for es-multi is green	PASS
ES index/search side effect for es-multi	PASS
ES direct Service health for es-multi is green	PASS

Cleanup

• Namespace elasticsearch-test-8190-signal: NotFound
• PV residual: none
• Both clusters: NotFound

Scope Boundary

This is a smoke/provision/service-connectivity early signal only. Plugins init image 0.1.0 does not include 8.19.0 IK/Pinyin binaries (graceful skip). This evidence does not cover: IK/Pinyin plugin functionality, ops, backup, chaos, soak, or full validation. Pending: apecloud/elasticsearch-plugins:0.1.1 build for full validation.

[leon-ape]

LGTM