# Can't change passwords in my-cluster-secrets

**URL:** <https://forums.percona.com/t/cant-change-passwords-in-my-cluster-secrets/8867>\
**Category:** Percona Operator for MySQL\
**Created:** [January 20, 2021, 2:22pm UTC](https://forums.percona.com/t/cant-change-passwords-in-my-cluster-secrets/8867 "2021-01-20T14:22:47Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmitriiu](https://avatars.discourse-cdn.com/v4/letter/d/958977/32.png) [@dmitriiu](https://forums.percona.com/u/dmitriiu)\
**Post date:** [January 20, 2021, 2:22pm UTC](https://forums.percona.com/t/cant-change-passwords-in-my-cluster-secrets/8867/1 "2021-01-20T14:22:47Z")

</div>

Hello, I’m facing a problem with passwords changing.  
First I deploy percona-operator and my-cluster-secrets with default passwords:

> root: cm9vdF9wYXNzd29yZA==  
> xtrabackup: YmFja3VwX3Bhc3N3b3Jk  
> monitor: bW9uaXRvcg==  
> clustercheck: Y2x1c3RlcmNoZWNrcGFzc3dvcmQ=  
> proxyadmin: YWRtaW5fcGFzc3dvcmQ=  
> pmmserver: c3VwYXxefHBheno=  
> operator: b3BlcmF0b3JhZG1pbg==  
> and everything’s ok.

Then I change secrets to custom this way

> stringData:  
> root: f13a826771  
> operator: xkijmtfjz8  
> monitor: 3i2sc5ehy2  
> clustercheck: x1o5xeol9e  
> proxyadmin: 1d567w40gs  
> xtrabackup: f894n8na58  
> pmmserver: x8gvn4n6kr

and remove these rows in proxysql config:

> ```
> admin_variables =
> {
> admin_credentials="proxyadmin:admin_password"
> cluster_username="proxyadmin"
> cluster_password="admin_password"
> 
> ```

> ```
> mysql_variables=
> {
> monitor_password="monitor"
> 
> ```

and proxysql pods restarting and start giving an errors:

> 2021-01-20 13:43:07 MySQL\_Session.cpp:4690:handler\_\_\_status\_CONNECTING\_CLIENT\_\_\_STATE\_SERVER\_HANDSHAKE(): [ERROR] ProxySQL Error: Access denied for user ‘proxyadmin’@‘127.0.0.1’ (using password: YES)  
> 2021-01-20 13:43:07 MySQL\_Monitor.cpp:1785:monitor\_galera\_thread(): [ERROR] Server percona-pxc-1.percona-pxc.\*\*\*.svc.cluster.local:3306 missed 3 Galera checks. Assuming offline

So,

1. what could be the reason?
2. what’s the correct procedure of password changing?
3. should these options exist: “admin\_credentials”, “cluster\_username”, “cluster\_password”, “monitor\_password” in proxysql configuration?
4. what is the purpose of the internal-percona secret, should there be any actions with it?

Can provide cr.yml and operator-deployment.yml manifests but can’t attach it for now because it restricted for the new users.

Thank you.

---

<div class="post-metadata">

**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\
**Post date:** [January 20, 2021, 3:14pm UTC](https://forums.percona.com/t/cant-change-passwords-in-my-cluster-secrets/8867/2 "2021-01-20T15:14:35Z")

</div>

Are you sure your passwords are base64 encoded in secrets.yaml? And next, did you re-deploy the secrets file?

---

<div class="post-metadata">

**Author:** ![dmitriiu](https://avatars.discourse-cdn.com/v4/letter/d/958977/32.png) [@dmitriiu](https://forums.percona.com/u/dmitriiu)\
**Post date:** [January 20, 2021, 5:16pm UTC](https://forums.percona.com/t/cant-change-passwords-in-my-cluster-secrets/8867/3 "2021-01-20T17:16:06Z")

</div>

Yes, k8s codes them from string to base64 by itself if there is “stringData” option. They match with manual coding by “echo -n … | base64”

First it was `k apply -f cluster-secrets-default.yml` with default passwords, then `k apply -f cluster-secrets-new.yml` with custom.

I just tried setting up a cluster with initially custom passwords in secret. Errors with proxyadmin persist. But there is a strange thing: I can connect with the custom root password directly to mysql from pxc pod. Seems that the secret applies, but not for all passwords.

---

<div class="post-metadata">

**Author:** ![Mykola](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/mykola/32/30_2.png) [@Mykola](https://forums.percona.com/u/Mykola)\
**Post date:** [February 11, 2021, 8:32am UTC](https://forums.percona.com/t/cant-change-passwords-in-my-cluster-secrets/8867/4 "2021-02-11T08:32:51Z")

</div>

Hi @dmitriiu

is this bug relevant to your case [[K8SPXC-641] Update of secret for proxyadmin user does not work properly - Percona JIRA](https://jira.percona.com/browse/K8SPXC-641) ?

---

<div class="post-metadata">

**Author:** ![dmitriiu](https://avatars.discourse-cdn.com/v4/letter/d/958977/32.png) [@dmitriiu](https://forums.percona.com/u/dmitriiu)\
**Post date:** [February 14, 2021, 9:04pm UTC](https://forums.percona.com/t/cant-change-passwords-in-my-cluster-secrets/8867/5 "2021-02-14T21:04:11Z")

</div>

hi, I didn’t notice that the new password was successfully applied to only one of the three nodes, but otherwise the bug is similar.

---

<div class="post-metadata">

**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\
**Post date:** [February 15, 2021, 8:37am UTC](https://forums.percona.com/t/cant-change-passwords-in-my-cluster-secrets/8867/6 "2021-02-15T08:37:35Z")

</div>

Yes, bug K8SPXC-641 covers this issue. It will be shipped in release 1.8.0.