[BUG] if you change default admin password which is "admin" cluster not getting up

[necipakca]

What is the bug?

I am trying to experiment operator, if I use default admin password everything works as expected. But if change the admin password all pods are giving that WARNING and cluster is not getting ready state.

Same situation valid for both existing or new cluster. I can not create new cluster if change admin password, also if I try to update existing cluster admin password also same.

[2025-10-06T07:39:28,665][WARN ][o.o.s.a.BackendRegistry ] [example-cls-os-data-0] Authentication finally failed for null from [::1]:54884

OpenSearch version : opensearch:3.2.0
Operator : opensearchproject/opensearch-operator:2.8.0

apiVersion: opensearch.opster.io/v1
kind: OpenSearchCluster
metadata:
  name: test
  namespace: test-ns
spec:
  security:
    # Operator will generate TLS certs if requested (per-node transport certs supported)
    tls:
      http:
        generate: true
      transport:
        generate: true
        perNode: true
    config:
      adminCredentialsSecret:
        name: opensearch-admin-credentials

apiVersion: v1
kind: Secret
metadata:
  name: opensearch-admin-credentials
  namespace: test-ns
type: Opaque
stringData:
  username: "admin"
  password: "91746596-c205-4a4b-9376"

[ragu2003]

You should also update the securityconfig secret.

Refer: #867

[necipakca]

You should also update the securityconfig secret.

Refer: #867

Thanks for the workaround. Adding internal_users.yaml solved the issue.
Normally, I was expecting the operator to handle this, since I am explicitly declaring the admin user using a secret:

      adminCredentialsSecret:
        name: opensearch-admin-credentials

I think opensearch-admin-credentials password always should override internal_users.yaml admin-hash.

[ragu2003]

Currently, opensearch-admin-credentials is only used by the Operator to make HTTP calls to the cluster.

OpenSearch cluster itself only uses it only for readiness probe.

Any other security changes are only done through securityconfig secret. As they are applied as it is.

[gaiksaya]

[Triage] @necipakca looks like the issue was resolved. Please re-open if you think otherwise.
Thanks!