{
  "schema_version": 2,
  "id": "operate/kubernetes/security/authentication/manage-redb-credentials",
  "title": "Manage Redis Enterprise database (REDB) passwords",
  "url": "https://redis.io/docs/latest/operate/kubernetes/8.2.0/security/authentication/manage-redb-credentials/",
  "summary": "Retrieve and rotate Redis Enterprise database (REDB) passwords on Kubernetes.",
  "content": "\nEach [`RedisEnterpriseDatabase`](https://redis.io/docs/latest/operate/kubernetes/reference/api/redis_enterprise_database_api) resource has a password stored under the `password` key of the secret named by `spec.databaseSecretName`. If you don't set `databaseSecretName`, the operator creates a secret named `redb-\u003cdatabase-name\u003e` with a random password and updates the REDB spec to reference it.\n\nThe operator reads the `password` key on every reconciliation and applies it to the database, so you rotate the password by updating the secret.\n\n## Retrieve the REDB password\n\n1. Find the secret name for the database:\n\n    ```sh\n    kubectl get redb \u003cdatabase-name\u003e -o jsonpath=\"{.spec.databaseSecretName}\"\n    ```\n\n2. Decode the password:\n\n    ```sh\n    kubectl get secret \u003csecret-name\u003e -o jsonpath=\"{.data.password}\" | base64 --decode\n    ```\n\n## Change the REDB password\n\n\u003e [!NOTE]\n\u003e If the REDB spec sets `defaultUser: false`, the operator does not create or update the database secret. Rotating the secret has no effect in that mode — manage credentials through [access control](https://redis.io/docs/latest/operate/kubernetes/security/access-control) instead, using [`RedisEnterpriseUser`](https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-users) resources.\n\n1. Base64-encode the new password. Use `echo -n` to avoid encoding a trailing newline:\n\n    ```sh\n    echo -n '\u003cnew-password\u003e' | base64\n    ```\n\n2. Patch the secret with the encoded value:\n\n    ```sh\n    kubectl patch secret \u003csecret-name\u003e -p='{\"data\":{\"password\":\"\u003cbase64-encoded-password\u003e\"}}'\n    ```\n\n    To edit the secret interactively, use `kubectl edit secret \u003csecret-name\u003e` and replace the `password` value.\n\n3. Verify that the operator applied the change. The REDB status moves to `active-change-pending` while the update is in flight and returns to `active` when complete:\n\n    ```sh\n    kubectl get redb \u003cdatabase-name\u003e -o jsonpath='{.status.status}'\n    ```\n\n    Then test the new password with a Redis client:\n\n    ```sh\n    redis-cli -h \u003cservice-name\u003e -p \u003cport\u003e -a '\u003cnew-password\u003e' PING\n    ```\n\nTo disable authentication for the default user, set the `password` value to an empty string.\n\n### Impact on existing client connections\n\nExisting client connections authenticated with the old password remain open — Redis Enterprise does not drop sessions when the password changes. New connections, and any `AUTH` commands issued on existing connections, must use the new password. Coordinate the secret update with your client configuration to avoid authentication errors.\n\n\u003e [!NOTE]\n\u003e For Active-Active databases, the database secret is not created automatically. See [Create a global database secret](https://redis.io/docs/latest/operate/kubernetes/active-active/global-db-secret).\n",
  "tags": ["docs","operate","kubernetes"],
  "last_updated": "2026-10-19T14:33:15-05:00"
}