doc: Document hot-reloading of security settings

Author: siegfriedweber

docs/modules/opensearch/examples/getting_started/opensearch-security-config.yaml

@@ -29,10 +29,12 @@ To make the metrics accessible for all users, especially Prometheus, anonymous a
 ----
 ---
 apiVersion: v1
-kind: Secret
+kind: ConfigMap
 metadata:
-  name: opensearch-security-config
-stringData:
+  name: custom-opensearch-security-config
+  annotations:
+    restarter.stackable.tech/ignore: "true"
+data:
   config.yml: |
     ---
     _meta:

docs/modules/opensearch/pages/usage-guide/monitoring.adoc

@@ -144,6 +144,31 @@ spec:
 
 If this role group is not defined, it will be created by the operator.
 
+[IMPORTANT]
+====
+Settings managed by the operator are hot-reloaded when changed, i.e. without pod restarts.
+However, if those settings are provided via ConfigMap or Secret, updates will normally trigger a restart.
+To prevent that restart, add the following annotation:
+
+[source,yaml]
+----
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: security-config
+  annotations:
+    restarter.stackable.tech/ignore: "true"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: security-config
+  annotations:
+    restarter.stackable.tech/ignore: "true"
+----
+====
+
 == TLS
 
 TLS is also managed by the OpenSearch security plugin, therefore TLS is only available if the security plugin was not disabled.

docs/modules/opensearch/pages/usage-guide/security.adoc

@@ -1,6 +1,35 @@
 = SDP upgrade notes
 :description: Instructions for upgrading the SDP versions.
 
+== Upgrade from SDP 26.3 to 26.7
+
+=== Hot-reloading of security settings
+
+The security settings defined in the cluster specification are now stored in a separate ConfigMap named `<cluster-name>-security-config`.
+If you used this name for your custom security configuration, then you must rename it.
+Otherwise the operator will override it.
+
+The operator now supports hot-reloading of security settings.
+If those settings are provided via ConfigMap or Secret, then the annotation `restarter.stackable.tech/ignore: "true"` should be added to avoid restarts triggered by the restart controller:
+
+[source,yaml]
+----
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: security-config
+  annotations:
+    restarter.stackable.tech/ignore: "true"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: security-config
+  annotations:
+    restarter.stackable.tech/ignore: "true"
+----
+
 == Upgrade from SDP 25.11 to 26.3
 
 When upgrading the OpenSearch operator from SDP 25.11 to 26.3, you may encounter several warnings and errors in the operator logs.