Work around this by disabling the ES firewall, which is ok in our case
because we dont expose the ES charm.
This means ES will be accessible to other applications in the deployment, but
it will remain inaccessible to the outside until an operator chooses to
expose it.
There's an issue when client-relation-changed calls ansible-playbook:
https://bugs.launchpad.net/elasticsearch-charm/+bug/1714393
Work around this by disabling the ES firewall, which is ok in our case because we dont expose the ES charm.
This means ES will be accessible to other applications in the deployment, but it will remain inaccessible to the outside until an operator chooses to expose it.