Currently:
S3: not watched, not reconciled, 3scale does not rolling update if it changes.
DB secrets: watched, reconcile only default values, 3scale does not rolling update if it changes.

If customer changes s3 or DB secrets, 3scale is not inmediatly rolling updated. But, if for any reason, there is a new deployment (like scaling up), the new configuration will be applied.

So, the operator cannot prevent applying new values from S3 or DB secrets.

Proposed change
Watch for changes in secrets and when change is detected, 3scale rolling update to apply new values immediately.