Currently we protect the OpenSearch cluster endpoints using basic auth. The opensearch user has full permissions for index-level operations, and that's fine for end users.

But SREs needing to perform some cluster operations (such as forcing shard reallocation) currently have to use the operator user, which is also used by the opensearch operator. We don't want humans and applications to use the same user, so let's:

• Create a separate admin user for cluster admins. It should be easy enough to auth via the same client certs that are available to the deploy users on the deployment hosts. Note that that would give application owners full permission to do these cluster operations as well, and that's OK.
• Verify operation.
• Update/create relevant docs.