{ "id": "manage-rec-credentials", "title": "Manage Redis Enterprise cluster (REC) credentials", "url": "https://redis.io/docs/latest/operate/kubernetes/security/authentication/manage-rec-credentials/", "summary": "", "tags": [ "docs", "operate", "kubernetes" ], "last_updated": "2026-07-24T10:52:10-07:00", "page_type": "content", "content_hash": "6b69e59d227469e56ff6899fee9ce562e1a9082b370c5ae43988c063ceebcbf2", "sections": [ { "id": "overview", "title": "Overview", "role": "overview", "text": "Redis Enterprise for Kubernetes uses a custom resource called [`RedisEnterpriseCluster`](https://redis.io/docs/latest/operate/kubernetes/reference/api/redis_enterprise_cluster_api) to create a Redis Enterprise cluster (REC). During creation, it generates random credentials for the operator to use. The credentials are saved in a Kubernetes (K8s) [secret](https://kubernetes.io/docs/concepts/configuration/secret/). The secret name defaults to the cluster name and is specified by the `clusterCredentialSecretName` field in the REC specification." }, { "id": "retrieve-the-current-username-and-password", "title": "Retrieve the current username and password", "role": "content", "text": "The credentials can be used to access the Redis Enterprise admin console or the API. Connectivity must be configured to the REC [pods](https://kubernetes.io/docs/concepts/workloads/pods/) using an appropriate service (or port forwarding).\n\n1. Inspect the random username and password created by the operator during creation with the `kubectl get secret` command.\n\n [code example]\n\n The command outputs the encoded password and username, similar to the example below.\n\n [code example]\n\n1. Decode each value with the `echo` and `base64` commands, using the encoded strings from the previous step:\n\n [code example]\n\n In this example, the plain text password is `12345678` and the username is `demo@example.com`." }, { "id": "change-the-redis-enterprise-cluster-rec-credentials", "title": "Change the Redis Enterprise cluster (REC) credentials", "role": "content", "text": "" }, { "id": "change-the-rec-password-for-the-current-username", "title": "Change the REC password for the current username", "role": "content", "text": "1. Access a [pod](https://kubernetes.io/docs/concepts/workloads/pods/) running a Redis Enterprise cluster:\n\n [code example]\n\n1. Add a new password for the existing user:\n\n [code example]\n\n1. From outside the pod, update the REC credential secret:\n\n [code example]\n\n1. Wait five minutes for all the components to read the new password from the updated secret. If you proceed to the next step too soon, the account could get locked.\n\n1. Access a pod running a Redis Enterprise cluster again:\n\n [code example]\n\n1. Remove the previous password to ensure only the new one applies:\n\n [code example]\n\n\nThe username for the K8s secret is the email displayed on the Redis Enterprise admin console." }, { "id": "change-both-the-rec-username-and-password", "title": "Change both the REC username and password", "role": "content", "text": "1. [Connect to the admin console](https://redis.io/docs/latest/operate/kubernetes/re-clusters/connect-to-admin-console.md).\n\n1. [Add another admin user](https://redis.io/docs/latest/operate/rs/security/access-control/create-users) and choose a new password.\n\n1. Specify the new username in the `username` field of your REC custom resource spec.\n\n1. Update the REC credential secret:\n\n [code example]\n\n1. Wait five minutes for all the components to read the new password from the updated secret. If you proceed to the next step too soon, the account could get locked.\n\n1. Delete the previous admin user from the cluster.\n\n\nThe operator may log errors in the time between updating the username in the REC spec and the secret update." }, { "id": "update-the-credentials-secret-in-vault", "title": "Update the credentials secret in Vault", "role": "content", "text": "If you store your secrets with HashiCorp Vault, update the secret for the REC credentials with the following key-value pairs:\n\n[code example]\n\nFor more information about Vault integration with the Redis Enterprise Cluster see [Integrating Redis Enterprise for Kubernetes with HashiCorp Vault](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/vault/README.md)." } ], "examples": [ { "id": "retrieve-the-current-username-and-password-ex0", "language": "sh", "code": "kubectl get secret rec -o jsonpath='{.data}'", "section_id": "retrieve-the-current-username-and-password" }, { "id": "retrieve-the-current-username-and-password-ex1", "language": "sh", "code": "map[password:MTIzNDU2NzgK username:ZGVtb0BleGFtcGxlLmNvbQo=]", "section_id": "retrieve-the-current-username-and-password" }, { "id": "retrieve-the-current-username-and-password-ex2", "language": "bash", "code": "echo MTIzNDU2NzgK | base64 --decode\n echo ZGVtb0BleGFtcGxlLmNvbQo= | base64 --decode", "section_id": "retrieve-the-current-username-and-password" }, { "id": "change-the-rec-password-for-the-current-username-ex0", "language": "sh", "code": "kubectl exec -it -0 -c redis-enterprise-node -- /bin/bash", "section_id": "change-the-rec-password-for-the-current-username" }, { "id": "change-the-rec-password-for-the-current-username-ex1", "language": "bash", "code": "REC_USER=\"`cat /opt/redislabs/credentials/username`\" \\\n REC_PASSWORD=\"`cat /opt/redislabs/credentials/password`\" \\\n curl -k --request POST \\\n --url https://localhost:9443/v1/users/password \\\n -u \"$REC_USER:$REC_PASSWORD\" \\\n --header 'Content-Type: application/json' \\\n --data \"{\\\"username\\\":\\\"$REC_USER\\\", \\\n \\\"new_password\\\":\\\"\\\"}\"", "section_id": "change-the-rec-password-for-the-current-username" }, { "id": "change-the-rec-password-for-the-current-username-ex2", "language": "sh", "code": "kubectl create secret generic \\\n --save-config \\\n --dry-run=client \\\n --from-literal=username= \\\n --from-literal=password= \\\n -o yaml | \\\n kubectl apply -f -", "section_id": "change-the-rec-password-for-the-current-username" }, { "id": "change-the-rec-password-for-the-current-username-ex3", "language": "sh", "code": "kubectl exec -it -0 -c redis-enterprise-node -- /bin/bash", "section_id": "change-the-rec-password-for-the-current-username" }, { "id": "change-the-rec-password-for-the-current-username-ex4", "language": "sh", "code": "REC_USER=\"`cat /opt/redislabs/credentials/username`\"; \\\n REC_PASSWORD=\"`cat /opt/redislabs/credentials/password`\"; \\\n curl -k --request DELETE \\\n --url https://localhost:9443/v1/users/password \\\n -u \"$REC_USER:$REC_PASSWORD\" \\\n --header 'Content-Type: application/json' \\\n --data \"{\\\"username\\\":\\\"$REC_USER\\\", \\\n \\\"old_password\\\":\\\"\\\"}\"", "section_id": "change-the-rec-password-for-the-current-username" }, { "id": "change-both-the-rec-username-and-password-ex0", "language": "sh", "code": "kubectl create secret generic \\\n --save-config \\\n --dry-run=client \\\n --from-literal=username= \\\n --from-literal=password= \\\n -o yaml | \\\n kubectl apply -f -", "section_id": "change-both-the-rec-username-and-password" }, { "id": "update-the-credentials-secret-in-vault-ex0", "language": "sh", "code": "username:, password:", "section_id": "update-the-credentials-secret-in-vault" } ] }