Resetting the admin@vsp.local password for VMware Cloud Foundation Services Runtime
search cancel

Resetting the admin@vsp.local password for VMware Cloud Foundation Services Runtime

book

Article ID: 444456

calendar_today

Updated On:

Products

VCF Automation VCF Operations

Issue/Introduction

  • You are unable to login to use the admin@vsp.local API account used for interacting with various components in running in a Services Runtime platform.
  • Password reset procedure for admin@vsp.local API account for VCF Services Runtime 9.1 is not functioning via the Fleet Management UI/API.

Environment

  • VCF Management Services 9.1.0
  • VCF Services Runtime 9.1.0

Resolution

Note:

  1. Identify and connect to a VCF services runtime control plane node virtual machine.
  2. Take a backup of the secret:
    kubectl get secret vsp-admin-secret -n vmsp-platform -o yaml > vsp-admin-secret.yaml.back
  3. Generate a password that meets the criteria for the vsp-admin password.

    Password Requirements:

    • Minimum length: 15
    • Maximum length: 64
    • At least:
      • 1 lowercase letter
      • 1 uppercase letter
      • 1 number
      • 1 of the following special characters: @ # $ ^ * !
    • Must NOT include:
      • Dictionary word
      • Palindrome
      • More than four monotonic character sequences
      • Three of the same consecutive character
  4. Update the cluster password with a temporary password:
    export NEW_PASSWORD='<complex_password_from_point_3>'
hash=$(echo ${NEW_PASSWORD} | vmsp passwd --password-stdin | tr -d "\n" | base64 -w0)

    When the password meets the criteria, you see a response similar to the following:

    2026/##/## 10:##:##/opt/vsp/password-policy.json not exist
2026/##/## 10:##:## validating password against local pwquality.conf

    Patch the secret:

    kubectl patch secret vsp-admin-secret -n vmsp-platform -p "{\"data\":{\"password\":\"${hash}\"}}"

    When the commands succeed, you see the following message:

    secret/vsp-admin-secret patched

Additional Information

  • The following script may be used to validate the newly reset password for admin@vsp.local successfully generates a bearer token and is working:
echo "Authenticating as admin@vsp.local..."
TOKEN=$(curl -sk --fail -XPOST \
    "${BASE_URL}/identity/token" \
    --header 'content-type: application/x-www-form-urlencoded' \
    --data 'grant_type=password' \
    --data 'username=admin@vsp.local' \
    --data "password=${VMSP_ADMIN_PASSWORD}" | jq -r '.access_token')

if [[ -z "$TOKEN" || "$TOKEN" == "null" ]]; then
    echo "ERROR: Failed to obtain Bearer token" >&2
    exit 1
fi

echo "Auth token obtained."

echo $TOKEN
Powered by Wolken Software