---
title: Rotate the Administrator Password
pubDate: 2026-08-17T09:53:44.266Z
antora:
  editUrl: https://github.com/couchbase/docs-operator/edit/release/2.9/modules/ROOT/pages/howto-admin-password-rotation.adoc
  xref: xref:operator::howto-admin-password-rotation.adoc[]
---

[Consult the llms.txt file for a full list of contents](/llms.txt)
[View original HTML](/operator/current/howto-admin-password-rotation.html)

# Rotate the Administrator Password

> How to rotate the administrator password. 

Password rotation is an essential part of maintaining high levels of security within a Couchbase cluster. For more information see the [credential rotation concepts documentation](concept-credential-rotation.md).

## [](#choosing-and-preparing-a-new-password)Choosing and Preparing a New Password

The first step to rotating a password is to generate a new one. It's recommended that you delegate this task to a dedicated tool that is good at this task. For the following demonstration we will use `apg`:

```console
$ apg -M SNCL -m 32 -n 1
MigdacalOn87scheav>odmagilEnhit9
```

When replacing secrets — for simplicity — we will do a straight swap, so need to base64 encode it:

```console
$ echo -n 'MigdacalOn87scheav>odmagilEnhit9' | base64
TWlnZGFjYWxPbjg3c2NoZWF2Pm9kbWFnaWxFbmhpdDk=
```

## [](#updating-the-administrator-secret)Updating the Administrator Secret

The administrator user secret is defined by the [couchbaseclusters.spec.security.adminSecret](resource/couchbasecluster.md#couchbaseclusters-spec-security-adminsecret) attribute in a `CouchbaseCluster` resource:

```console
$ kubectl get couchbasecluster/cb-example -o json | jq .spec.security.adminSecret
"cb-example-auth"
```

Next, edit the secret:

```console
$ kubectl edit secret/cb-example-auth
# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: v1
data:
  password: cGFzc3dvcmQ= (1)
  username: QWRtaW5pc3RyYXRvcg==
kind: Secret
metadata:
  creationTimestamp: "2020-11-11T11:17:25Z"
  name: cb-example-auth
  namespace: default
  resourceVersion: "1890"
  selfLink: /api/v1/namespaces/default/secrets/cb-example-auth
  uid: 96350ef3-2548-4a7a-b4cc-1f074d0c1c09
type: Opaque
```

| **1** | Replace the password data item with our new, base64 encoded value, save and quit from your editor. |
| ----- | -------------------------------------------------------------------------------------------------- |

Your resource should look like the following after editing:

```yaml
# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: v1
data:
  password: TWlnZGFjYWxPbjg3c2NoZWF2Pm9kbWFnaWxFbmhpdDk=
  username: QWRtaW5pc3RyYXRvcg==
kind: Secret
metadata:
  creationTimestamp: "2020-11-11T11:17:25Z"
  name: cb-example-auth
  namespace: default
  resourceVersion: "1890"
  selfLink: /api/v1/namespaces/default/secrets/cb-example-auth
  uid: 96350ef3-2548-4a7a-b4cc-1f074d0c1c09
type: Opaque
```

You can verify the change has been successfully made by consulting the logs:

```console
$ kubectl logs -f deployment/couchbase-operator
...
{"level":"info","ts":1605093846.9616146,"logger":"cluster","msg":"Rotating admin password","cluster":"default/cb-example"}
```

The Operator will also raise an event that can be monitored by an external client:

```console
$ kubectl describe couchbasecluster/cb-example
...
Events:
  Type    Reason                Age    From  Message
  ----    ------                ----   ----  -------
  Normal  AdminPasswordChanged  3m23s        The cluster admin password was changed
```