Packaging a deb with the plugins seems doable, it will involve some manual steps to upload the jars to copper but this can be automated with a bash script.
FTR here is the raw discussion

10:44 <moritzm> the packaging itself is fairly straightforward:
10:44 <dcausse> I'd prefer to write a simple build script that download the zips from its original source, explode them then build the deb 
10:44 <moritzm> - a minimal rules file with dh
10:44 <moritzm> - a debian/control file with the basic parameters like package name
10:44 <moritzm> - a debian/foo.install referencing the jars
10:45 <moritzm> then build it on copper
10:45 <gehel> moritzm: and where do you get the .jars? Download them directly from upstream?
10:45 <moritzm> (that's the part that gehel would need to take care of, since copper is restricted)
10:46 <moritzm> gehel: I was under the impression upstream ships these jar? but I don't know much about elastic plugins
10:46 <dcausse> moritzm: it's a zip file with jars in them
10:47 <gehel> moritzm: my understanding was that we don't want network access during build, so we need to bring those jars to copper in some way...
10:47 <moritzm> hey provide their debs via secure apt (i.e. with signed hashes), maybe they offer signed hashes for the ZIP files as well
10:47 <moritzm> gehel: extract the zip file into the root directory of your debian package tree
10:48 <moritzm> and reference the jars in the .install files
10:48 <moritzm> the scp the entire packge tree to copper, build and upload on install1002
10:48 <gehel> so the download and extract the .zip is a manual step (or at least a step before packaging itself)
10:49 <moritzm> then you have all the ameneties of a Debian package, like using apt, debdeploy, internal repo etc.
10:49 <moritzm> gehel: yes, that would be manual, but if it only happens 4/5 times a year not worth automating
10:50 <gehel> and it can be automated with ~5 lines of bash...
10:50 <moritzm> yep

Change 352170 had a related patch set uploaded (by DCausse; owner: DCausse):
[operations/software/elasticsearch/plugins@master] [WIP] Switch this repo to a deb package

https://gerrit.wikimedia.org/r/352170

Salt will be removed from production in Q1 (2017-2018) so this task must be addressed before then.

I don't have anything useful to add and I already gave this a token, but here's another thumbs up: 👍

Thanks again for working on this!

@dcausse : I built a package using the new approach (with the two changes I mentioned wrt gpg->gnupg and setting DISTRIBUTION to jessie) and that worked well, result is here in case you want to test further: https://people.wikimedia.org/~jmm/elastic/

@MoritzMuehlenhoff I tested the package you generated and it seems to work well, thanks!
(I amended the patch with your suggestions)

Change 375812 had a related patch set uploaded (by Gehel; owner: Gehel):
[operations/puppet@production] elasticsearch - deploy plugins with debian package instead of trebuchet

https://gerrit.wikimedia.org/r/375812

Change 352170 merged by Gehel:
[operations/software/elasticsearch/plugins@master] Switch this repo to a deb package

https://gerrit.wikimedia.org/r/352170

Mentioned in SAL (#wikimedia-operations) [2017-09-12T08:38:07Z] <gehel> deploying elasticsearch plugins on relforge - T158560 (wrong ticket number before)

Deployment on relforge:

• stop puppet
• rm -rf /srv/deployment/elasticsearch/plugins/
• rm -rf /usr/share/elasticsearch/plugins
• apt-get install wmf-elasticsearch-search-plugins
• reinstall kuromoji plugin

Mentioned in SAL (#wikimedia-operations) [2017-09-12T14:02:18Z] <gehel> switching elasticsearch plugin deployment to .deb instead of scap on cirrus/codfw - T158560

Mentioned in SAL (#wikimedia-operations) [2017-09-12T14:05:59Z] <gehel> restarting elasticsearch on elastic2001 to validate new plugin deployment - T158560

Mentioned in SAL (#wikimedia-operations) [2017-09-12T14:07:25Z] <gehel> switching elasticsearch plugin deployment to .deb instead of scap on cirrus/eqiad - T158560

Mentioned in SAL (#wikimedia-operations) [2017-09-12T14:10:16Z] <gehel> restarting elasticsearch on elastic1020 to validate new plugin deployment - T158560

Change 375812 merged by Gehel:
[operations/puppet@production] elasticsearch - deploy plugins with debian package instead of trebuchet

https://gerrit.wikimedia.org/r/375812

Mentioned in SAL (#wikimedia-operations) [2017-09-12T15:35:39Z] <gehel> restart elasticsearch on relforge (last check of new plugin deployment) - T158560

New plugins are deployed, elasticsearch has been restarted on 2 nodes to validate. I'm waiting for the elasticsearch 5.5.x upgrade to restart the full cluster.