Add docs on upgrading the keystore

This commit adds a note to the docs regarding upgrading the keystore.

docs/reference/setup/secure-settings.asciidoc

@@ -91,6 +91,23 @@ To remove a setting from the keystore, use the `remove` command:
 bin/elasticsearch-keystore remove the.setting.name.to.remove
 ----------------------------------------------------------------
 
+[float]
+[[keystore-upgrade]]
+=== Upgrading the keystore
+
+Occasionally, the internal format of the keystore changes. When Elasticsearch is
+installed from a package manager, an upgrade of the on-disk keystore to the new
+format is done during package upgrade. In other cases, Elasticsearch will
+upgrade perform such an upgrade during node startup. This requires that
+Elasticsearch have write permissions to the directory that contains the
+keystore. Alternatively, you can manually perform such an upgrade by using the
+`upgrade` command:
+
+[source,sh]
+----------------------------------------------------------------
+bin/elasticsearch-keystore upgrade
+----------------------------------------------------------------
+
 [float]
 [[reloadable-secure-settings]]
 === Reloadable secure settings