Resetting the admin@vsp.local password for VMware Cloud Foundation Services Runtime

Products

VCF Automation

Issue/Introduction

You are unable to login to use the admin@vsp.local API account used for interacting with various components in running in a Services Runtime platform.
Password reset procedure for admin@vsp.local API account for VCF Services Runtime 9.1 is not functioning via the Fleet Management UI/API.

Environment

VCF Management Services 9.1.0
VCF Services Runtime 9.1.0

Resolution

Note:

Follow this process only when you are unable to manage the admin@vsp.local password via the Fleet Management UI/API.
If the password is known and you simply wish to reset it, see Update Passwords for VMware Cloud Foundation Components.

Identify and connect to a VCF services runtime control plane node virtual machine.
- Establish an SSH Connection to a VCF Services Runtime Instance.
- If you have forgotten the vmware-system-user password, see Resetting the vmware-system-user password for VMware Cloud Foundation Services Runtime.

Take a backup of the secret:

kubectl get secret vsp-admin-secret -n vmsp-platform -o yaml > vsp-admin-secret.yaml.back

Generate a password that meets the criteria for the vsp-admin password.
Password Requirements:
- Minimum length: 15
- Maximum length: 64
- At least:
  - 1 lowercase letter
  - 1 uppercase letter
  - 1 number
  - 1 of the following special characters: @ # $ ^ * !
- Must NOT include:
  - Dictionary word
  - Palindrome
  - More than four monotonic character sequences
  - Three of the same consecutive character

Update the cluster password with a temporary password:

export NEW_PASSWORD='<complex_password_from_point_3>'
hash=$(echo ${NEW_PASSWORD} | vmsp passwd --password-stdin | tr -d "\n" | base64 -w0)

When the password meets the criteria, you see a response similar to the following:

2026/##/## 10:##:##/opt/vsp/password-policy.json not exist
2026/##/## 10:##:## validating password against local pwquality.conf

Patch the secret:

kubectl patch secret vsp-admin-secret -n vmsp-platform -p "{\"data\":{\"password\":\"${hash}\"}}"

When the commands succeed, you see the following message:

secret/vsp-admin-secret patched

Additional Information

To confirm that the admin@vsp.local password has been reset successfully and now generates a bearer token the following can be used:

Authenticate to a VCF Services Runtime control plane node as vmware-system-user and export the Kubernetes configuration with the following commands:
```
sudo -i 
export KUBECONFIG=/etc/kubernetes/admin.conf
```
Query the HTTP route for the identity server to extract the VCF services runtime FQDN (VSP):
```
kubectl get httproute vmsp-identity-server-route -n vmsp-platform
```
Run the following command replacing <VSP_FQDN> with the output from the previous command:
```
export BASE_URL="<VSP_FQDN>"
```
Run the following command replacing <NEW_PASSWORD> with the recently reset admin@vsp.local password:
```
export VSP_ADMIN_PASSWORD='<NEW_PASSWORD>'
```

un the following code block to confirm that it is now possible to generate a bearer token using the admin@vsp.local account:

echo 'Authenticating as admin@vsp.local...'
TOKEN=$(curl -sk --fail -XPOST \
    "https://${BASE_URL}/api/v1/identity/token" \
    --header 'content-type: application/x-www-form-urlencoded' \
    --data 'grant_type=password' \
    --data 'username=admin@vsp.local' \
    --data "password=${VSP_ADMIN_PASSWORD}" | jq -r '.access_token')
if [[ -z "$TOKEN" || "$TOKEN" == "null" ]]; then
    echo "ERROR: Failed to obtain Bearer token" >&2
else
 echo "Auth token obtained."
 echo $TOKEN
fi

Subscribe to this article to receive updates on permanent fix status: KB 275360