Skip to content

security

How to Reset the ArgoCD Admin Password

ArgoCD

ArgoCD initial administrator credentials are automatically generated during installation and stored in the argocd-initial-admin-secret Kubernetes Secret.

Once customized or deleted, the active admin password hash is maintained inside the argocd-secret Secret. If the admin password is lost or locked out, follow the recovery procedure below.

Password Reset Workflow

graph LR
    Step1["1. Patch argocd-cm ConfigMap<br/>(Enable admin account)"] --> Step2["2. Remove admin.password key<br/>from argocd-secret"]
    Step2 --> Step3["3. Restart argocd-server Pod<br/>(Regenerates default password)"]

Step 1. Ensure the Admin Account is Enabled

Ensure admin.enabled: true is present in the argocd-cm ConfigMap:

kubectl patch -n argocd configmap argocd-cm --type merge -p '{"data":{"admin.enabled":"true"}}'

Step 2. Remove Existing Password Hash from argocd-secret

Remove the admin.password and admin.passwordMtime keys from the argocd-secret Secret:

kubectl patch secret argocd-secret -n argocd --type json \
  -p='[{"op": "remove", "path": "/data/admin.password"}, {"op": "remove", "path": "/data/admin.passwordMtime"}]'

Example structure of argocd-secret:

apiVersion: v1
kind: Secret
metadata:
  name: argocd-secret
  namespace: argocd
type: Opaque
data:
  server.secretkey: K1ZCZlpEeWYwMFpjUzV5NG5tTUROOFllS0plYz0=

Step 3. Restart the ArgoCD Server Pod

Restarting the argocd-server deployment causes it to detect the missing admin password hash and regenerate the initial admin password:

kubectl rollout restart deployment argocd-server -n argocd

# Retrieve newly generated password
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d && echo