Would it be reasonable to create the _users database upon cluster initialization? If it doesn't make sense in all cases, would it be reasonable to do it optionally if a config value (createUsersDatabase = true?) is set?

If this is something we want, I'm happy to work on a PR.

I'm not sure of the best approach. One possibility would be to create a Job resource that effectively calls curl -X PUT http://.../_users. There might be some cleaner way I haven't thought of. I'm eager to hear other suggestions, if this is deemed worth pursuing.