{
  "id": "manage-redb-credentials",
  "title": "Manage Redis Enterprise database (REDB) passwords",
  "url": "https://redis.io/docs/latest/operate/kubernetes/security/authentication/manage-redb-credentials/",
  "summary": "Retrieve and rotate Redis Enterprise database (REDB) passwords on Kubernetes.",
  "tags": [
    "docs",
    "operate",
    "kubernetes"
  ],
  "last_updated": "2026-07-24T10:52:10-07:00",
  "page_type": "content",
  "content_hash": "60615bbde6a76faa945e2bcf47051bd7a08a5e80c2395134b47ca65f139f798c",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "Each [`RedisEnterpriseDatabase`](https://redis.io/docs/latest/operate/kubernetes/reference/api/redis_enterprise_database_api) resource has a password stored under the `password` key of the secret named by `spec.databaseSecretName`. If you don't set `databaseSecretName`, the operator creates a secret named `redb-<database-name>` with a random password and updates the REDB spec to reference it.\n\nThe operator reads the `password` key on every reconciliation and applies it to the database, so you rotate the password by updating the secret."
    },
    {
      "id": "retrieve-the-redb-password",
      "title": "Retrieve the REDB password",
      "role": "content",
      "text": "1. Find the secret name for the database:\n\n    [code example]\n\n2. Decode the password:\n\n    [code example]"
    },
    {
      "id": "change-the-redb-password",
      "title": "Change the REDB password",
      "role": "content",
      "text": "If the REDB spec sets `defaultUser: false`, the operator does not create or update the database secret. Rotating the secret has no effect in that mode — manage credentials through [access control](https://redis.io/docs/latest/operate/kubernetes/security/access-control) instead, using [`RedisEnterpriseUser`](https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-users) resources.\n\n\n1. Base64-encode the new password. Use `echo -n` to avoid encoding a trailing newline:\n\n    [code example]\n\n2. Patch the secret with the encoded value:\n\n    [code example]\n\n    To edit the secret interactively, use `kubectl edit secret <secret-name>` and replace the `password` value.\n\n3. Verify that the operator applied the change. The REDB status moves to `active-change-pending` while the update is in flight and returns to `active` when complete:\n\n    [code example]\n\n    Then test the new password with a Redis client:\n\n    [code example]\n\nTo disable authentication for the default user, set the `password` value to an empty string."
    },
    {
      "id": "impact-on-existing-client-connections",
      "title": "Impact on existing client connections",
      "role": "content",
      "text": "Existing client connections authenticated with the old password remain open — Redis Enterprise does not drop sessions when the password changes. New connections, and any `AUTH` commands issued on existing connections, must use the new password. Coordinate the secret update with your client configuration to avoid authentication errors.\n\n\nFor Active-Active databases, the database secret is not created automatically. See [Create a global database secret](https://redis.io/docs/latest/operate/kubernetes/active-active/global-db-secret)."
    }
  ],
  "examples": [
    {
      "id": "retrieve-the-redb-password-ex0",
      "language": "sh",
      "code": "kubectl get redb <database-name> -o jsonpath=\"{.spec.databaseSecretName}\"",
      "section_id": "retrieve-the-redb-password"
    },
    {
      "id": "retrieve-the-redb-password-ex1",
      "language": "sh",
      "code": "kubectl get secret <secret-name> -o jsonpath=\"{.data.password}\" | base64 --decode",
      "section_id": "retrieve-the-redb-password"
    },
    {
      "id": "change-the-redb-password-ex0",
      "language": "sh",
      "code": "echo -n '<new-password>' | base64",
      "section_id": "change-the-redb-password"
    },
    {
      "id": "change-the-redb-password-ex1",
      "language": "sh",
      "code": "kubectl patch secret <secret-name> -p='{\"data\":{\"password\":\"<base64-encoded-password>\"}}'",
      "section_id": "change-the-redb-password"
    },
    {
      "id": "change-the-redb-password-ex2",
      "language": "sh",
      "code": "kubectl get redb <database-name> -o jsonpath='{.status.status}'",
      "section_id": "change-the-redb-password"
    },
    {
      "id": "change-the-redb-password-ex3",
      "language": "sh",
      "code": "redis-cli -h <service-name> -p <port> -a '<new-password>' PING",
      "section_id": "change-the-redb-password"
    }
  ]
}