Resetting the [email protected] password for VMware Cloud Foundation Services Runtime

Products

• VCF Automation
• VCF Operations

Issue/Introduction

• Unable to login to use the [email protected] API account used for interacting with various components in running in a Services Runtime platform.
• Password reset procedure for [email protected] API account for VCF Services Runtime 9.1 is not functioning via the Fleet Management UI/API.

Environment

• VCF Management Services 9.1.0
• VCF Services Runtime 9.1.0

Resolution

Note:

• Follow this process only when the user is unable to manage the [email protected] password via the Fleet Management UI/API.
• If the password is known, simply reset it, see Update Passwords for VMware Cloud Foundation Components.

1. Identify and connect to a VCF services runtime control plane node virtual machine.
   • Establish an SSH Connection to a VCF Services Runtime Instance.
   • In the event that the vmware-system-user password is forgotten, see Resetting the vmware-system-user password for VMware Cloud Foundation Services Runtime.
2. Take a backup of the secret:

   kubectl get secret vsp-admin-secret -n vmsp-platform -o yaml > vsp-admin-secret.yaml.back

3. Generate a password that meets the criteria for the vsp-admin password.

   Password Requirements:

   • Minimum length: 15
   • Maximum length: 64
   • At least:
     • 1 lowercase letter
     • 1 uppercase letter
     • 1 number
     • 1 of the following special characters: @ # $ ^ * !
   • Must NOT include:
     • Dictionary word
     • Palindrome
     • More than four monotonic character sequences
     • Three of the same consecutive character
4. Update the cluster password with a temporary password:

   export NEW_PASSWORD='<complex_password_from_point_3>'
   hash=$(echo ${NEW_PASSWORD} | vmsp passwd --password-stdin | tr -d "\n" | base64 -w0)

   When the password meets all required criteria, output similar to the following is displayed::

   2026/##/## 10:##:##/opt/vsp/password-policy.json not exist
   2026/##/## 10:##:## validating password against local pwquality.conf

   Patch the secret:

   kubectl patch secret vsp-admin-secret -n vmsp-platform -p "{\"data\":{\"password\":\"${hash}\"}}"

   Upon successful execution of the commands, the following message is displayed:

   secret/vsp-admin-secret patched

Additional Information

If the '[email protected]' password has expired:

1. Back up the admin secret
   
   kubectl -n vmsp-platform get secret vsp-admin-secret -o json > /root/vsp-admin-secret.bak.json
ls -l /root/vsp-admin-secret.bak.json
   
   
2. Confirm the current state (whether the password has expired)
   
   kubectl -n vmsp-platform get secret vsp-admin-secret -o json | jq '.metadata.annotations | with_entries(select(.key|test("expiryDate|lastRotatedTimestamp|loginAttempts|lockoutDate")))'
   
   
3. Update the password. Make sure you know the current password
   
   read -s -p 'CURRENT [email protected] password: ' OLD_PW; echo
read -s -p 'NEW [email protected] password: ' NEW_PW; echo

curl -sSk -X POST "https://<fqdn>/api/v1/identity/users/[email protected]" -H 'Content-Type: application/json' -d "$(jq -n --arg o "$OLD_PW" --arg n "$NEW_PW" '{oldPassword:$o,newPassword:$n}')"
   
   
4. Validate the password expiry
   
   kubectl -n vmsp-platform get secret vsp-admin-secret -o json | jq '.metadata.annotations | with_entries(select(.key|test("expiryDate|lastRotatedTimestamp|loginAttempts|lockoutDate")))'

curl -sSk -X POST "https://<fqdn>/api/v1/identity/token" -H 'Content-Type:application/x-www-form-urlencoded' --data-urlencode grant_type=password --data-urlencode [email protected] --data-urlencode "password=$NEW_PW"

 

If the Control Plane node is not visible in the UI, identify the target node using memory allocation metrics:

1. Open the vCenter and locate the directory containing the Virtual Machines (VMs).

2. Inspect the resource consumption metrics for all VMs within that folder.

3. Identify the VM with the lowest memory usage—this instance corresponds to the affected Control Plane node.

 

 

To confirm that the [email protected] password has been reset successfully and now generates a bearer token the following can be used:

1. Authenticate to a VCF Services Runtime control plane node as vmware-system-user and export the Kubernetes configuration with the following commands:

   sudo -i 
   export KUBECONFIG=/etc/kubernetes/admin.conf

2. Query the HTTP route for the identity server to extract the VCF services runtime FQDN (VSP):

   kubectl get httproute vmsp-identity-server-route -n vmsp-platform

3. Run the following command replacing <VSP_FQDN> with the output from the previous command:

   export BASE_URL="<VSP_FQDN>"

4. Run the following command replacing <NEW_PASSWORD> with the recently reset [email protected] password:

   export VSP_ADMIN_PASSWORD='<NEW_PASSWORD>'

5. Run the following code block to confirm that it is now possible to generate a bearer token using the [email protected] account:

   echo 'Authenticating as [email protected]...'
   TOKEN=$(curl -sk --fail -XPOST \
       "https://${BASE_URL}/api/v1/identity/token" \
       --header 'content-type: application/x-www-form-urlencoded' \
       --data 'grant_type=password' \
       --data '[email protected]' \
       --data "password=${VSP_ADMIN_PASSWORD}" | jq -r '.access_token')
   if [[ -z "$TOKEN" || "$TOKEN" == "null" ]]; then
       echo "ERROR: Failed to obtain Bearer token" >&2
   else
    echo "Auth token obtained."
    echo $TOKEN
   fi